Answer:
1 the data must be processed fairly, lawfully and transparently
2 the data must be processed only for specific, explicit and legitimate purposes and shall not be further processed in any manner incompatible with that purpose or those purposes
3 the data must be adequate, relevant, and not excessive in relation to the purpose or purposes for which they are held
