Is the processing necessary to achieve the stated purpose? - Could the same purpose be achieved with less data, less intrusive methods, or without personal data? - Is the data collection proportionate to the benefit sought? - Have data minimization principles been applied?