The Purposes of Processing under the GDPR

One of the fundamental principles of data protection law, which has been further strengthened under the EU’s General Data Protection Regulation (GDPR), is the requirement that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. This principle, known as “purpose limitation,” is enshrined in Article 5(1)(b) of the GDPR.

I - Understanding the Purpose Limitation Principle

The purpose limitation principle is a cornerstone of the GDPR and serves to protect data subjects by ensuring that their personal data is only used in ways that they would reasonably expect and have been informed about. It consists of two key components:

1. Data must be collected for specified, explicit and legitimate purposes: This means that at the time of data collection, the controller must clearly and specifically define the purposes for which the data will be processed. These purposes must be legitimate, meaning they must be in accordance with the law and not violate the rights and freedoms of data subjects.

2. Data must not be further processed in a manner that is incompatible with those purposes: Once personal data has been collected for a specified purpose, it should not then be repurposed and processed in a way that is incompatible with the original purpose. If the controller wishes to process the data for a new purpose, they must either obtain fresh consent from the data subject or ensure that the new purpose is compatible with the original purpose.

II - Specifying Purposes

When specifying the purposes of processing, controllers need to be clear, unambiguous, and specific. Vague or general descriptions such as “improving user experience,” “marketing purposes,” or “future research” will not suffice. Instead, purposes should be granular and clearly articulated, for example:

• “To process your order and arrange delivery of products”
• “To send you our monthly newsletter containing product updates and special offers”
• “To analyze website usage data to identify areas for improvement in site navigation and content”

Importantly, these specified purposes must then be communicated to data subjects in a clear and transparent way, typically through privacy notices or policies at the point of data collection.

III - Compatible Purposes

The GDPR recognizes that it’s not always possible or practical to obtain fresh consent from data subjects every time a controller wants to process their data for a new purpose. Therefore, the Regulation allows for further processing without new consent where the new purpose is deemed “compatible” with the original purpose.

To determine whether a new processing purpose is compatible with the original purpose, controllers should take into account factors such as:

• Any link between the original and new purposes
• The context in which the data was collected and the reasonable expectations of data subjects
• The nature of the personal data, particularly whether it involves special categories of data or criminal offense data
• The possible consequences of the new processing for data subjects
• The existence of appropriate safeguards, such as encryption or pseudonymization

Where a controller determines that a new processing purpose is compatible, they should still update their privacy notice to inform data subjects of this additional purpose.

IV - Incompatible Purposes and Fresh Consent

If a controller wishes to process personal data for a purpose that is incompatible with the original purpose, they will generally need to obtain fresh consent from the data subject. This new consent must meet all the requirements of the GDPR, meaning it must be freely given, specific, informed and unambiguous.

There are some limited exceptions to this requirement for fresh consent, such as where the processing is necessary for compliance with a legal obligation, to protect the vital interests of the data subject, or for the performance of a task carried out in the public interest. However, these exceptions are narrowly defined and controllers should be cautious about relying on them without a clear justification.

V - Enforcement and Penalties

Failure to comply with the purpose limitation principle can result in significant penalties under the GDPR. Supervisory authorities such as the UK’s Information Commissioner’s Office (ICO) have the power to issue fines of up to €20 million or 4% of a company’s global annual turnover, whichever is higher, for infringements of this and other key principles of the Regulation.

In addition to financial penalties, non-compliance can also lead to reputational damage, loss of customer trust, and even legal action from affected data subjects. It’s therefore crucial that controllers take their obligations around purpose specification and compatible processing seriously.

Conclusion

The purpose limitation principle is a fundamental tenet of the GDPR that aims to give data subjects control over how their personal information is used. By requiring controllers to specify clear, legitimate purposes for processing and ensuring that any further processing is compatible with those original purposes, the Regulation seeks to promote transparency and prevent misuse of personal data.

To comply with this principle, controllers must carefully consider and clearly articulate the purposes for which they collect and process personal data, communicate these purposes to data subjects, and implement robust processes to assess the compatibility of any new processing purposes. By doing so, they can not only avoid costly penalties but also build trust with customers and uphold the fundamental rights and freedoms of individuals.