Data minimization requires organizations to collect and process only personal information that is adequate, relevant, and necessary for the specified purpose. A basic to-do application may reasonably require limited account or contact information, but political opinions and trade-union affiliations have no apparent necessity for compiling, researching, or prioritizing tasks. Those attributes are also treated as particularly sensitive under European data-protection law. Privacy by design requires privacy safeguards and data-protection principles to be incorporated into the product from the design stage and reflected in default settings.
Therefore, unnecessary collection at installation directly implicates both minimization and privacy by design.
Purpose limitation may also become relevant, but explicit consent does not by itself cure unjustified overcollection. Transparency, portability, and access rights address different privacy obligations and do not best characterize the defect described here.