. "Authorities are not permitted to collect any data except the most obvious like name and address; when doing so, worst-case scenarios must be assumed." . . . .