Data Protection Principle 6