You may use collected PII data only in the following circumstances:

• to fulfill legal obligations you have toward the data subject

• to fulfill legal obligations you have as a data controller

• for the purpose stated when receiving consent for data collection

Under certain circumstances (see article 18), the data subject can stop you from using their PII data. In these cases, you must ensure that the data is retained in your systems but not used. (The data subject cannot stop you from using data in cases where you are legally obligated to pass on PII data to authorities.)