I recently wrote a more professional article on bisi.lu about how the risk calculation around children’s data has changed. That article started from a disturbing case: publicly available school photos were reportedly misused with artificial intelligence to create harmful images of children. The point was simple: a photo is no longer just a photo. A list of names is no longer just a list of names. A form is no longer just a form. But the more I think about it, the more I realise that the real problem starts much earlier. It starts when we are asked to hand over personal information and nobody really explains why. Not clearly. Not simply. Not in a way that makes the person in front of the form understand what is really happening with their data.

A young person close to me recently applied for a student job. Already at the first application stage, the requested information felt excessive: bank details, social security number, a photo and other personal data. Maybe some of that information becomes necessary later. If someone is hired, of course an employer needs certain administrative details. Nobody is denying that. But why at the first application? Why before a decision has even been made? Why collect sensitive or unnecessary data from every applicant, including those who will never be selected? That little word matters: why. It is not aggressive. It is not anti-administration. It is not paranoia. It is the most basic data protection question there is.

The same pattern appears in sport. A sports club asks families for a long list of personal information. Some of it may be necessary. Some of it may be required by a federation. Some of it may help with subsidies. But again, the explanation is often weak, vague or missing. In one case, after creating a normal user account, it became possible to find the names of other people registered in the same club. The explanation was that this was a useful feature for reserving a court with another member. Useful, perhaps. But necessary? That is the difference we still struggle with. A feature can be practical and still be a bad idea. A database can be convenient and still expose too much information. A form can be normal in an organisation and still ask for more than it should.

Another recent moment stayed with me. A healthcare worker involved in the care of an elderly person close to me asked where that person had worked before retiring. It sounded harmless. It was probably routine. But when I asked why this information was needed, who would have access to it, how long it would be stored and how it would be protected, there was no clear answer. I am not saying that such a question can never be relevant. If someone spent forty years working in a mine, a factory, with toxic substances or in another environment that could explain health issues, then yes, previous employment may be medically relevant. But if there is no such link, why collect the name of an employer from twenty years ago? Because the software has a field? Because the form has always asked for it? Because “we always do it like this”? That is not enough.

This is where the discussion often goes wrong. As soon as someone asks questions about data protection, some people react as if they are being accused of wrongdoing. But asking “why” is not an attack. It is a responsibility. It is a way of protecting children, elderly people, families, patients, volunteers, club members and citizens. I understand that good data protection can feel annoying. It creates extra work. It forces organisations to write things down, clarify procedures, review old habits and sometimes admit that they collected too much for too long. But the alternative is worse. The alternative is a society where personal data keeps moving through forms, inboxes, spreadsheets, club accounts, municipal systems and shared mailboxes without anyone really knowing who has it, why they have it, how long they keep it and what could happen if it is misused.

I sometimes hear people talk about GDPR as if it were the enemy. “Too much paperwork.” “Too many rules.” “Everything is complicated now.” I understand the frustration. Really, I do. But GDPR was not created to make life harder for a tennis club, a municipality, a school or a care service. It exists because personal data matters. It exists because information about people can be misused. It exists because children, elderly people, patients and citizens should not have to blindly trust every form put in front of them. And it exists because “we are serious people, we would never abuse this information” is not a data protection system. Good intentions are not enough. Professionalism is not enough. Trust is important, but trust should never replace clear rules.

For me, the most important cultural change would already be very small. Every parent, every citizen, every patient, every club member, every applicant should feel allowed to ask: why do you need this information?

And then maybe follow up with more questions such as: Who will see it? How long will you keep it? Where will it be stored? What happens if I do not provide it? Can the same goal be reached with less information?

These are not hostile questions. They are healthy questions. And any organisation that handles personal data should be able to answer them calmly.

This matters even more when young people are involved. When young people apply for jobs, join clubs, take part in activities or appear in public events, adults have an extra responsibility. We should not just ask whether we have a form. We should ask whether the form is proportionate. We should not just ask whether we have consent. We should ask whether the situation is respectful. We should not just ask whether something is allowed. We should ask whether it is right. Because data protection is not only about databases. It is also about power. A young person applying for a job may not feel comfortable questioning a municipality. A child joining a club cannot evaluate what happens to their personal documents. An elderly person receiving care may answer personal questions because they assume they have to. That is exactly why adults, parents and citizens need to keep asking why.

Before collecting personal data, every organisation should ask itself one simple question: do we truly need this? Not: could this be useful? Not: have we always asked for it? Not: does the software have a field for it? Not: would it be convenient later? Do we truly need this, for this purpose, at this stage? If the answer is no, then don’t collect it. If the answer is yes, explain it. That alone would already change a lot.

I still believe in schools, clubs, communes, healthcare workers and public services. Most people working there are trying to do their jobs properly. Many are overwhelmed. Many inherited old procedures. Many never received proper training. But that cannot be the end of the conversation, because the world has changed. Data travels faster. Documents are copied more easily. Photos can be manipulated. Old files can resurface. Shared inboxes can become archives nobody controls. Artificial intelligence has made the misuse of personal information easier, faster and more dangerous.

So no, asking “why” is not mistrust. It is citizenship. It is parenting. It is care. And if every one of us asked that little question more often, many organisations would finally have to build better answers.