Data defense legislation will carry on to apply. This suggests there will have to often be a valid lawful foundation for the collection and processing of persona