While discussing my privacy design strategies paper at PLSC 2013, an interesting issue came up. The question was whether privacy by design can be used to enforce proportionality. That question was asked to me before, and my standard response was that it only partially can. You can use strategies like minimisation and, to a lesser extent, aggregation to ensure that the system only processes the personal data that it needs. However, whether that need itself is proportional, or even legitimate, is not something the design itself can guarantee.