Section 4: Legal basis for processing personal data