> I think limiting utilization and retention is key.

I think the retention point is valuable. But it also seems sort of impossible in some arenas.

Take Facebook. Say that the government can only retain information it collects for 6 months. Fine; but they could re-request that same data 6 months later.

I suppose there is always a way around this (no extensions without a warrant), but in principle retention seems both critical and a minefield of potential confusion. I'd be interested to hear others' thoughts on the topic.