GDPR demands legitimate basis, data minimization in addition to security. – bonus spinmama