https://gdprinfo.eu/cs/cs-chapter-4-section-4