Any data you collect that you do not unambiguously need to provide the service would be an appeal for "legitimate interest" as a legal basis for collecting it. There are a number of things GDPR writes about it and of course you cannot be sure how this will play out in practice, but the main points are:

* it must be reasonable from the user's perspective

* there must be alternative; you cannot achieve the goal (your "legitimate interest") without it

* it must be balanced with the rights of the user, and not infringe on their freedom or fundamental rights

* if your "legitimate interest" is direct marketing, the user can always object, and you are required to actively inform the user of this right

See also [1]

[1] https://gdpr-info.eu/recitals/no-47/

I think you meant "no alternative" under the second bullet point.

Strictly has a pretty clear definition.

If you can provide a service strictly devoid of the PII it means there is no logical necessity for PII.

You can't provide a call-waiting service without a phone number, but you can provide a mail-redirection service without one even though it makes it easier to administer when you have a customer phone number, you can strictly provide (and bill/administer) the service when that information is absent.

from molf's comment: >The alternative is to only collect data that is strictly necessary to provide the service.

While I agree with your comment, I suspect that for any given law firm, paramTotalHours_Billable(SubjectID = necessary) will be a much larger value.

I assume it's "you cannot provide said service without having said data".