Altering requirements for a controller to limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed.