Data Protection Act 1998

3U.K.Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.