The fundamental principle of data protection is not the “consent principle”, but the purpose specification principle, worded in art. 6 of the Data Protection Directive, which foresees that personal data may only be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes”, and that they should be “adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed and “accurate and, where necessary, kept up to date”. Often, these two principles – the purpose specification and the data quality principles – are coined as the data minimisation principle.