At a neighbourhood library, the team wanted to send activity reminders to people living a few streets away. The proposal sounded considerate: with a more precise address, the supplier said, it could recommend workshops without filling anyone’s inbox with notices. During a test session, a library user asked why the library needed to know her building number to invite her to a talk she could find in the calendar herself. The question changed the centre of the conversation. An institution’s closeness can make a request feel ordinary; it does not make that request necessary on its own.
Local organisations have a delicate advantage. They know names, routines, places, and needs that do not appear on a distant platform. That familiarity can help them care better, solve things earlier, or explain a service in situated language. It can also lower everyone’s guard. When the person asking for a detail works for the council, school, clinic, association, or shop seen every week, it is harder to ask whether the detail is essential, how long it will be kept, or where else it may travel. Trust is exactly why the duty to justify every request should be stronger, not weaker.
Making the context clear#
The first step is to separate a possible service from necessary data. An exact coordinate may make a recommendation more precise, but that does not mean it is a condition for providing the recommendation. A freely chosen neighbourhood, a broad area, a preference a person can edit, or no new information at all will often do. One useful question is: if this field disappeared tomorrow, which specific task could we no longer perform? If the answer is that the task would be less convenient or the segmentation less refined, then the field may be an optional improvement rather than a requirement.
The first step is to separate a possible service from necessary data. An exact coordinate may make a recommendation more precise, but that does not mean it is a condition for providing the recommendation.
Minimisation is not a way to build worse services. It is design work. It asks a team to imagine alternatives before adding a field: a public noticeboard, voluntary topic subscriptions, a partial postcode, a one-time query that is not retained, or referral to a person who can hear the situation. These choices can require more imagination than collecting another attribute, but they give people more room to decide what relationship they want with a service. They also reduce possible harm if an unauthorised access, configuration mistake, or future reuse changes the setting in which information was originally supplied.
What changes in practice#
An honest form makes the difference between informing and steering visible. Informing means stating next to a field why it is requested, whether it is mandatory, how long it is held, and how consent can be withdrawn. Steering means hiding conditions behind a pre-ticked box, relying on broad phrases such as “to improve your experience,” or turning a refusal into a path of obstacles. A simple test is to let someone complete the process without providing the additional detail. If that decision triggers repeated screens, artificial delay, or language that induces guilt, the choice is not truly free.
Proportion also depends on timing. Someone may share an address so that home delivery can take place and not want that same address to feed outreach campaigns, profiles, or comparisons across services. Providing a fact once is not permanent permission for new purposes. Every change of purpose deserves a specific explanation and a practical way to decline. This discipline prevents a record created for one act of care from gradually becoming infrastructure for everyday surveillance, without anyone openly deciding to make that change.
Deciding with information#
It is especially important to consider who has the least freedom to refuse a request. A family needing a place, a recent arrival who does not speak the dominant language, someone relying on a benefit, or a neighbour who knows the staff member may agree because they fear losing something. Voluntariness is not measured only by a checkbox; it is measured by the power relationship around it. Explanations in more than one language, offline alternatives, and separation between data needed to access a service and data used for communication are modest measures that make refusal more possible.
The library chose to test a change. For open activities it replaced detailed address collection with three areas selected by the user and a topic subscription that could be cancelled with one click or at the desk. For home delivery it asked for the address only while the delivery was active and removed it from the operational list when the service ended, unless the person asked to retain a preference. The team did not lose contact with the neighbourhood. It gained a more honest conversation about what it truly needed and stopped treating precision as a synonym for attention.
Reviewing and adjusting#
Small decisions need visible rules to endure. A short inventory can state which fields exist, which task each one supports, who can see them, where they are stored, and when they are deleted. It is not necessary to publish details that create a new risk; it is necessary for the organisation to answer those questions without improvising. When nobody knows why a field remains in a database, that field no longer serves a defined need. Reviewing the inventory before a campaign, supplier change, or connection between tools helps identify uses that have grown merely by inertia.
Team language matters too. Saying “we already have it” does not answer whether it can be used again. Saying “just in case” does not define a purpose. It is useful for someone in a meeting to be responsible for asking awkward questions: what happens if we do not collect this, can we offer the same right without this detail, what harm would an incorrect inference cause, and who will tell people if the use changes? Making those questions a normal part of work prevents caution from depending on a single person brave enough to pause a nearly finished project.
Technical security remains necessary, but it cannot be the only answer. Encrypting a database or restricting permissions reduces certain risks; it does not turn excessive collection into justified collection. The best protection for a detail that does not need to be retained is not to retain it. Where information is necessary, protection combines technical safeguards with time limits, accountable owners, and simple ways to correct or delete a record. Privacy resembles a series of decisions taken before a detail enters through the door more than a lock installed at the end of the process.
To see whether practice is improving, an organisation can follow concrete signals: how often optional fields are used, how many people choose alternative routes, how long deletion requests take, and how many purposes have been retired because they could not be justified. Those numbers require context. Less collection may mean a form is more respectful, or it may mean that a useful option was poorly explained. Metrics should therefore sit beside short conversations, especially with people who often have the least room to challenge a request. Their accounts can reveal a pressure that does not appear in a dashboard.
Nearby trust should not be bought with intimate information. It is built when an institution shows it can be available without wanting to know everything, can offer help without turning every contact into a profile, and can explain its limits without defensive language. The library user was not refusing activity information. She was asking to receive it without supplying a precision that was not needed. Hearing that distinction makes more hospitable services possible: services that come close to people without entering further into their lives than the work requires.
One action can begin this week. Choose a routine form and review every field with three questions: which concrete task does it enable, what less intrusive alternative exists, and when will it be deleted? If there is no clear answer, removing the field for now is more responsible than retaining it from habit. Then ask someone to follow the service path while withholding optional data. The experience will show whether proximity is being practised as care or as permission. Very often, the difference is decided in a single box.
