[WG-PEMC] acm code of ethics would be a good reference

ACM 2018 Code of Ethics and Professional Conduct would always apply "Only the minimum amount of personal information necessary should be collected in a system. The retention and disposal periods for that information should be clearly defined, enforced, and communicated to data subjects. Personal information gathered for a specific purpose should not be used for other purposes without the person's consent. Merged data collections can compromise privacy features present in the original collections. Therefore, computing professionals should take special care for privacy when merging data collections" https://www.acm.org/code-of-ethics