> Processing shall be lawful […] if […] processing is necessary for compliance with a legal obligation to which the controller is subject;