It's a good start but I feel like this should go hand-in-hand with privacy by default. Security is about protecting data (as well as preventing fraud and some other things) and data minimization reduces the attack surface.

In other words this reads a bit like how you can protect your safe full of wads of cash when the real question should be whether you need to store that money in cash in the first place.