Question / answer about the purpose of the data processing

Can personal data be used for other purposes?

While browsing the web, I arrived to discover the website of the European Commission, there are develop several types of articles on the RGPD.

One raises the question of processing the data for all possible purposes and the second is whether to use the data for other purposes. Here is the link of the article to introduce you to the source of the information.

Can we use personal data?

Answer

No. You must know for what purpose you wish to process the personal data and inform the persons whose data you are processing. You can not simply indicate that the personal data will be collected and processed. This point is known as the principle of "purpose limitation".

References

Article 29 Working Party, Opinion 03/2013 on limitation of purposes (WP 203)

 

Can personal data be used for other purposes?

Answer

  • Yes, but only in some cases. If your company / organization has collected data on the basis of a legitimate interest, a contract or vital interests, these can be used for another purpose but only after verifying that the new purpose is compatible with the initial purpose.

  • Attention should be paid to the following points:

  • the link between the initial purpose and the new or future purpose;

  • the context in which the data was collected (What is the relationship between your company / organization and the data subject?);

  • the type and nature of the data (Are they sensitive?);

  • the possible consequences of the envisaged future treatment (what impact will it have on the person concerned?);

  • the existence of appropriate safeguards (such as encryption or pseudonymisation).

If your company / organization wishes to use the data for statistical or scientific research purposes, it is not necessary to perform a compatibility test.

If your company / organization has collected data on the basis of consent or in accordance with a legal requirement, no further processing beyond the scope of the areas covered by the original consent or legal provision is possible. Further processing would require obtaining a new consent or a new legal basis.

Examples

Further treatment is possible

A bank has a contract with a client to provide a bank account and a personal loan. At the end of the first year, the bank uses the client's personal data to check whether it is eligible for a better type of loan and a savings plan. She informs the client. The bank can again process the customer's data because the new purposes are compatible with the original purposes.

Further processing is not possible

The same bank wants to share the client's data with insurance companies, relying on the same contract relating to a bank account and a personal loan. This processing is not permitted without the explicit consent of the client as the purpose is not compatible with the original purpose for which the data was processed.

References

  • Article 5 (1) (b), Article 6 (4), Article 89 (1) and Recitals (39) and (50) of the GDPR
  • Article 29 Working Party, Opinion 03/2013 on limitation of purposes (WP 203)

I hope you enjoyed reading, I advise you to read on the same subject the article asking the question on the type of data that can be treated and under what conditions?

 

Various articles on the GDPR that could interest you ...