Sensitive personal data of a population in the wrong hands is dangerous data; a tool for genocide. Minimisation principle of data. protection implies that a Data Controller or Data Processor processes only that data, necessary to fulfil the purpose for which it was collected. It is a technical and organizational measure that ensures privacy by design and default.

In his 1996 book Ethnic Cleansing, Andrew Bell-Fialkoff locates genocide and ethnic cleansing within a continuum of eliminationist population policies, offering a definition of ‘population cleansing’: “Population cleansing is a planned, deliberate removal from a certain territory of an undesirable population distinguished by one or more characteristics such as ethnicity, religion, race, class, or sexual preference. These characteristics must serve as the basis for removal for it to qualify as cleansing.

Just to mention, the genocide against the Tutsis in Rwanda was seriously aided by uncontrolled and unfettered access to sensitive personal data of the population particularly on tribe on “indangamuntu”-ID. During the 1994 genocide in Rwanda, ID cards identifying people by their so-called “ethnic group” served, for some, as an effective death sentence. The post-colonial Rwandan authority’s decision to include “ethnic group identities” on ID cards, which had originally been introduced back in 1933 by the Belgian colonial government, not only brought the very idea of rigid racial group identities to the fore, but it also “facilitated the identification of victims” and meant that the genocide took place in a terrifyingly systematic and organized way. Data gathering around sensitive topics has a long history of being used in malicious and dangerous ways including genocides. Accordingly, ethnic cleavage through IDs can act as a tool for genocide. An estimated over one million Tutsis were killed while thousands suffered crimes against humanity. The sanctity of the right to life is a non-derogable norm and cannot be sold at the altar of ethnic data. Identification of individual members of a targeted population group is a necessary task for perpetrators of genocide and ethnic cleansing. To accomplish this task, perpetrators either adapt existing administrative structures to their new purposes or create new structures. Identity cards are often the key element in a larger identification system. Their central position in such a system is due to their role in attaching the identity of the targeted group onto individual persons, combining individual identity information with a group profile. Notably, the current national IDs in Rwanda do not bear ethnicity details.

In Germany, Nazi authorities sought new ways to publicly identify Jews during the late 1930s. Under the “Law on Alteration of Family and Personal Names” of 1938, Jewish women and girls were forced to take the name “Sara” as their legal middle names. Jewish men were forced to adopt the middle name “Israel.” Nazi authorities also stamped the letter “J” on all Jews’ passports and issued the Jewish population new identity cards with the letter “J” to be carried on their persons at all times. Signs of these discriminatory measures were embedded in the identity card.

Ethnicity data is sensitive personal data. Ethnicity as a death sentence witnessed in massacres and genocides is a trend that must be ebbed. If the 1994 genocide against the Tutsis and the 1938 genocide against the Jews in Nazi Germany is anything to go by. The underlying denominator that facilitated the genocides is ethnicity data.

History confirms that lack of minimisation of sensitive data of a population can be a root-cause for genocide. Practising data minimisation is a keystone of a rights-based, responsible data protection approach. EU Policy Framework on Transitional Justice provides principles that advocate for a Rights-Based Approach to

---

---