The approach, first developed by Ann Cavoukian, Ontario's information and privacy commissioner, includes protections such as collecting only the data needed for a specific business purpose and retaining data only as long as necessary to fulfill that purpose.