Questão 96633

The General Data Protection Regulation (GDPR) establishes key principles for data processing. Understanding these is vital for any ICT professional dealing with user data from the European Union. Analyze the following scenarios in the context of GDPR principles:

I. An e-commerce website collects user data, including name, address, and purchase history, for order fulfillment. It then uses this same data for targeted marketing campaigns without obtaining separate, explicit consent. This action potentially violates the principle of 'purpose limitation'.

II. A company collects extensive personal data from its users for a specific service, but its privacy policy vaguely states that the data 'may be used to improve services' without providing clear details. This could be in breach of the principles of 'lawfulness, fairness and transparency'.

III. A financial services app requires users to provide data far beyond what is necessary for its core function, such as access to their social media contacts, under the pretext of 'enhancing user experience'. This practice directly contradicts the principle of 'data minimization'.

Which of the scenarios correctly identify a potential violation of a GDPR principle?