The purpose of the personal data processing activity must not be able to be achieved by a less intrusive method.