Article 7.4 and recital 43 of GDPR cover that. Article 7 https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ Recital 43 https://gdpr-info.eu/rec

Article 7.4 and recital 43 of GDPR cover that. Article 7 https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ Recital 43 https://gdpr-info.eu/recitals/no-43/ https://gdpr-info.eu/recitals/no-43/ Those two in combination stop companies processing data for unrelated task to the services they provide. And it's indeed true and already been applied, see this: https://www.digitalguardian.com/blog/google-fined-57m-data-protection-watchdog-over-gdpr-violations https://www.digitalguardian.com/blog/google-fined-57m-data-p...