{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"privacy","domain":["Data Protection & Privacy"],"inherent_rating":"high","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-excessive-collection-purpose-creep","description":"Collecting more personal data than necessary (data-minimization failure) and using it for purposes materially different from those disclosed without fresh notice/consent, expanding attack surface and violating purpose-limitation.","details":{"category":"privacy","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"data-excessive-collection-purpose-creep","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:data-excessive-collection-purpose-creep","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-excessive-collection-purpose-creep","sourceIds":["ccpa","gdpr","hipaa","iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Excessive collection, purpose creep and secondary use","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:935e9a602ba4f4838a2f1ac695db1d0e5817c01284ccf83483362e67b49b5cf3","properties":{"rationale":"Purpose limitation plus the minimum-necessary standard directly restricts over-use/over-disclosure and blocks secondary use without new authority.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:baaaaa8d759ae4bf52b2d5f55d12b851386e7e17eba2c7717b63e8850555e773","properties":{"rationale":"Collecting personal data only for the documented purposes constrains over-collection and purpose creep at the point of collection.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb610d04c71da3f279147ee116490166020dfc381a936ab40d1bddb6767a0c60","properties":{"rationale":"PII-protection requirements include data-minimization and purpose-limitation, directly addressing over-collection and purpose creep.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-13-c09befaf.json","sourceId":"uc:UC-DATA-13","targetDetailPath":"/data/v1/records/risk-data-excessive-collection-purpose-creep-4a691595.json","targetId":"risk:data-excessive-collection-purpose-creep","type":"mitigates"}],"schemaVersion":1}