Recital 170 mentions “Since the objective of this Regulation, namely to ensure an equivalent level of protection of natural persons and the free flow of personal data throughout the Union, cannot be sufficiently achieved by
the Member States and can rather, by reason of the scale or effects of the action, be better achieved at Union
level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union (TEU). In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.”
Proportionality says that personal data should be collected according to the purpose of processing, that is, proportional, and data that will not be used for the purpose should not be collected.
Subsidiarity is a principle that says that personal data can only be processed if there are no other means to achieve the objective. Therefore, the less personal data used, the less the possibilities of violating privacy.
