97It should also be noted that, in accordance with Article 5 of the GDPR, the controller bears the burden of proving that those data are collected, inter alia, for specified, explicit and legitimate purposes, that they are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed and that they are processed lawfully, fairly and in a transparent manner in relation to the data subject (see, to that effect, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 95).
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.