The basic principle applied is that Group employees may only collect, process and store personal data if this is required for a specifically defined purpose and in the lawful performance of their duties, or if there is another legal basis for this.