  This paper determines, through an interdisciplinary law and computer science
lens, whether data minimisation and purpose limitation can be meaningfully
implemented in data-driven algorithmic systems, including personalisation,
profiling and decision-making systems. Our analysis reveals that the two legal
principles continue to play an important role in mitigating the risks of
personal data processing, allowing us to rebut claims that they have become
obsolete. The paper goes beyond this finding, however. We highlight that even
though these principles are important safeguards in the systems under
consideration, there are important limits to their practical implementation,
namely, (i) the difficulties of measuring law and the resulting open
computational research questions as well as a lack of concrete guidelines for
practitioners; (ii) the unacknowledged trade-offs between various GDPR
principles, notably between data minimisation on the one hand and accuracy or
fairness on the other; (iii) the lack of practical means of removing personal
data from trained models in order to ensure legal compliance; and (iv) the
insufficient enforcement of data protection law.
