A verifier should not require your full identifier when proving age, eligibility or another attribute is sufficient.
Arts. 74–75 and 79 · less data, less correlation
Data minimisation and minimum disclosure
The constitutional architecture prefers proving the necessary attribute over exposing the entire identity. Collecting data “because it may be useful one day” is incompatible with purpose limitation, necessity and minimisation.
Proposed Constitution · reference text · not promulgatedIn brief
Minimisation is a design rule: reduce collection, retention, correlation and disclosure without reducing the service’s legitimate capability.
The constitutional architecture prefers proving the necessary attribute over exposing the entire identity. Collecting data “because it may be useful one day” is incompatible with purpose limitation, necessity and minimisation.
Prove without revealing everything
When a service only needs to know whether a person meets a requirement, the proposed Constitution favours attribute proofs and minimum disclosure. The entire Root Identity should not be exposed when a less revealing proof satisfies the purpose with sufficient assurance.
Compartmentalise before centralising
Art. 75 rejects a universal unified database when the purpose can be achieved through compartmentalised systems. Sharing between bodies requires a legal basis, demonstrable necessity and a recorded purpose.
- Collect only necessary categories.
- Separate databases with different functions.
- Avoid general cross-sector correlation.
- Limit retention and operator access.
- Reassess necessity when the purpose changes.
What this means for you
How this right appears in practice
Identity, election or benefit data do not automatically become a general-purpose training dataset.
An external provider should receive only what is necessary for the function it performs.
Implication for people who use Candeia
When a corresponding operation exists in Sistema Candeia, it will be carried out by the competent module. GOV.CANDEIA explains rules, limits and pathways; it does not make the decision or create legal status on its own.
Limits and institutional honesty
What this safeguard does not mean
Minimisation does not mean the absence of records necessary for audit, evidence and continuity.
For some acts, a higher level of identification may be legally necessary and proportionate to the risk.
A materially identifiable person remains protected even when the data are labelled anonymous.
How this function connects to Sistema Candeia
Enter Candeia OSAccess through Candeia OS
When a corresponding operation exists in Sistema Candeia, it will be carried out by the competent module. GOV.CANDEIA explains rules, limits and pathways; it does not make the decision or create legal status on its own.
Continue reading