Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.