https://gdprinfo.eu/cs/cs-chapter-3-section-3