personal data should be processed only to the extent necessary for each specific purpose, and by default should not be made accessible to an indefinite number of people.