38 – There must not be any less restrictive, but equally effective alternatives (necessity stage), i.e. there are no alternative less invasive measures. – The measure must not have a disproportionate impact on the right holder (balancing stage), i.e. there is a proper relation between the importance of achieving the aim and importance of limiting the right. X. BECAUSE this is Hon’ble Court in Puttaswamy (Privacy) and Puttaswamy (Aadhaar) recognised, and endorsed, the privacy principles as elaborated in the Justice A.P. Shah Report which will be applicable in the present case to ascertain the vires of Section 69 of the IT Act. These privacy principles pertain to notice, choice and consent, collection limitation, purpose limitation, access and correction, non-disclosure of information, security of data, openness or proportionality as to the scale, scope and sensitivity to the data collected, and accountability. XI. BECAUSE this Hon’ble Court in Puttaswamy (Privacy) and Puttaswamy (Aadhaar) also took note of the fundamental principles of data collection, processing, and storage that reflect the proportionality principle and also underpin the EU General Data Protection Regulation [“EU GDPR”]. These include: principle of lawfulness, fairness, and transparency: that personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject; principle of purpose limitation: that the personal data must be collected for specified, explicit, and legitimate purposes;