What does “purpose limitation” mean under the GDPR?

There are seven basic data protection principles under EU data protection law. The second principle is the principle of “purpose limitation” (GDPR Article 5 (1) (b)).

Article 5 of GDPR

Personal data shall be:

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

[See also Articles 6 and 26 of GDPR]

The principle of “purpose limitation”

To ensure that the reasons for processing are clear and open, and in line with the reasonable expectations of the individuals concerned, EU data protection law requires that the purposes for the processing be specified. This is fundamental to building public trust.

In practice, this means that entities must:

• be clear from the outset why they are collecting personal data and what you intend to do with it;
• comply with documentation obligations to specify your purposes;
• comply with transparency obligations to inform individuals about your purposes; and
• ensure that if any use or disclose for any purpose that is additional to or different from the originally specified purpose is fair, lawful and transparent.

Entities required to comply with documentation and transparency obligations are likely to comply with the requirement to specify purposes without doing anything more:

• Records of processing (documentation) obligations (see Article 30 GDPR).
• Information to be provided to individuals (see Article 13 et sec GDPR).

EU data protection law does not ban the use of information for purposes other than those for which it was collected, however there are restrictions. In essence, if the purposes change, the processing is still legal provided that:

• the new purpose is compatible with the original purpose;
• individual’s specifically consent to the new purpose; OR there is a clear legal provision requiring or allowing the new processing in the public interest.

What are ‘compatible purposes’?

The GDPR specifically says that the following are compatible purposes:

• archiving purposes in the public interest;
• scientific or historical research purposes; and
• statistical purposes.

Otherwise, the GDPR says that the following factors should be taken into account when deciding whether a new purpose is compatible with the original purpose:

• any link between your original purpose and the new purpose;
• the context in which you originally collected the personal data — in particular, your relationship with the individual and what they would reasonably expect;
• the nature of the personal data — eg is it particularly sensitive;
• the possible consequences for individuals of the new processing; and
• whether there are appropriate safeguards — eg encryption or pseudonymisation.

Example: A GP discloses his patient list to his wife, who runs a travel agency, so that she can offer special holiday deals to patients needing recuperation. Disclosing the information for this purpose would be incompatible with the purposes for which it was obtained.

ICO Checklist

The Information Commissioner’s Office website includes a helpful Checklist that summarizes this principle:

Consequences of non-compliance

Failure to comply with data protection principles may lead to substantial fines. Article 83(5)(a) of GDPR states that infringements of the basic principles for processing personal data are subject to the highest tier of administrative fines. This could mean a fine of up to €20 million, or 4% of your total worldwide annual turnover, whichever is higher.

NOTES:

Recitals - (39) Principles of Data Processing (74) Responsibility and Liability of the Controller

Additional relevant provision in GDPR include Article 6(4) (Additional Purposes), and Recital 50 (further processing).

ADDITIONAL RESOURCES

• You can find A29WP Opinion on purpose limitation here