Article 29 Working Party Opinion
When an organisation collects personal data about an individual, that individual has certain expectations about the purposes for which the data will be used. The question arises as to the extent to which the data may be used for other purposes. The Working Party has said that personal data must be collected for "specified, explicit and legitimate" purposes and not be "further processed in a way incompatible with those purposes". Thus, further processing for a different purpose may be acceptable as long as it is compatible. The factors that need to be taken into account are the relationship between the purposes to which the personal data have been collected and the purposes of such further processing; the context in which the personal data have been collected and the reasonable expectations of data subjects; and the safeguards adopted by the controller to ensure fair processing and to prevent any undue impact on data subjects. This contrasts with the ICO view where the suggested test is one of "fairness".
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.