Understanding and Applying the General Data Protection Regulation (GDPR): The Five Basic Principles of Data Protection -- Principle 3, Data Collection Limits
The General Data Protection Regulation states that only those data shall be collected that are appropriate and immediately necessary for the stated purpose. (Data Collection Limits, Privacy by Design, Privacy by Default)