‘Data minimisation’ is a major component of the legislation in both the GDPR and CPRA