I Learned a New Word Today

data protection Jan 13, 2022

I learned a new word today.

It was in a Privacy Policy.

Just when I thought the depths had already been plumbed as deep as they would go with privacy policies, some idiot presented me with this,


Yes, I had to go and look it up.  My memory isn't what it once was.

It was used in the context of trying to impress upon the reader that the website using this privacy policy was collecting personal data of such little consequence that we needn't bother or concern ourselves about it.  Specifically it was used to describe the data collected during the website visit.  You know, unimportant things like IP addresses...

As in, "We collect a nugatory amount of data when..."


Dictionary Definition

The dictionary definition of "nugatory" is, "of no value or importance", or, "useless or futile".

Which raises an important data protection question, to be answered by the smart alec who wrote this particular privacy policy.

If the data you collect is "of no value or importance", WHY are you collecting it?

An IP address is personal data.  I am not often given to quoting the text of the GDPR, I find I usually have other things to do, yet today I'll make an exception.

Article 5/1/c:  "Personal data shall be... adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed."

Which means, in my little mind, that if you collect personal data but it is of no value or importance, you are actually in breach of the data minimisation principle.  You are processing personal data you don't need.

This privacy policy then goes on to state it's going to keep this  personal data which is, "of no value or importance" for three years.  Which could well be a breach of the storage limitation principle.

Oh the tangled web we weave...


The Lesson for Today

Be careful with the words you use if you absolutely must make use of a privacy policy and plonk it on your website.  I can only imagine the evil Dick Dastardly grin on the face of whoever it was thought of using the word, "nugatory".  Not understanding that if there is an incident, someone even smarter will read this and use it to string up the data controller.

Better still, use a privacy notice and use it properly.  I can show you how.

Every day a new learning opportunity...


50% Complete

Two Step

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.