Section 22

The collection of Personal Data shall be limited to the extent

necessary in relation to the lawful purpose of the Data Controller.