Judgment_paragraph 27 · Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság (C-77/21)

27Regarding, first, the requirement that personal data are to be collected for specified, explicit and legitimate purposes, it follows from the case-law of the Court that that requirement implies, first of all, that the purposes of the processing are to be identified at the latest at the time of the collection of the personal data, next, that the purposes of that processing are to be clearly stated and, finally, that the purposes of that processing are to guarantee, inter alia, the lawfulness of the processing of those data, within the meaning of Article 6(1) of Regulation 2016/679 (see, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C‑175/20, EU:C:2022:124, paragraphs 64 to 66).