Purpose limitation is the principle that personal data may only be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
Content
The purpose must be established before the data is collected and described specifically enough for the extent of the processing to be derived from it. General wording such as improving our services is not sufficient.
Change of purpose
Further processing for another purpose is permitted if it is compatible with the original purpose. Factors to be examined include the link between the purposes, the context in which the data was collected, the nature of the data, the possible consequences and existing safeguards such as encryption or pseudonymisation.
The data subject must be informed of a change of purpose in advance. Archiving, research and statistical purposes are considered compatible, subject to certain safeguards.
Legal provisions
- Art. 5(1)(b) GDPR
- Principle of purpose limitation.
- Art. 6(4) GDPR
- Criteria for the compatibility of a change of purpose.
- Art. 13(3) GDPR
- Information on further processing for other purposes.
- Sections 23 and 24 BDSG
- National rules on change of purpose.
Related terms.
Legal basis for processing The legal basis is the statutory permission on which any processing of personal data must be based in order to be lawful. Art. 6(1) GDPR Census judgment (Volkszählungsurteil) The census judgment is the decision of the Federal Constitutional Court of 15 December 1983 which established the right to informational self-determination. BVerfG, judgment of 15 December 1983 