52In addition, under Article 5(1)(b) of the GDPR, which sets out the principle of purpose limitation of the processing of personal data, such data must be, first, collected for specified, explicit and legitimate purposes and, second, not further processed in a manner that is incompatible with those purposes. In accordance with the case-law of the Court, that principle requires, first of all, that the purposes of the processing be identified at the latest at the time of the collection of the personal data, next, that the purposes of that processing be clearly stated and, lastly, that the purposes of that processing guarantee, inter alia, the lawfulness of the processing of those data, within the meaning of Article 6(1) of the GDPR (see, to that effect, judgment of 20 October 2022, Digi, C‑77/21, EU:C:2022:805, paragraph 27 and the case-law cited).