white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 5: PURPOSE SPECIFICATION AND USE LIMITATION
5.1 Introduction
(i)
Purpose Specification Principle
Purpose Specification is an essential first step in applying data protection laws and designing
safeguards for the collection, use and disclosure of personal data. 485 The principle of purpose
limitation is designed to establish the boundaries within which personal data collected for a
given purpose may be processed and may be put to further use. As described in the OECD
Guidelines 486 , the principle has two components: the data must be collected for a specified
purpose and once the data is collected, it must not be processed further in a manner which is
incompatible with the purpose for collection. Each subsequent use must be specified at the
time of change of purpose. For instance, if a clothing store collects an individual‘s address for
the purpose of delivering goods she has ordered, and later uses this information to send her
promotional material, this would not be permitted; as such use is incompatible with the
original purpose. This principle is closely linked to the Use Limitation principle (described
below) and the Data Quality Principle (described in Part III, Chapter 7 of the White Paper).
Specifying the purpose of collection and ensuring that further use is in line with the purpose
of collection contributes to transparency, legal certainty and predictability in the data
collection process. This principle also gives an individual control over her data by allowing
her to set limits on how her personal information will be used. It also ensures that collection
is lawful and fair, and prevents further use that may be unexpected, inappropriate or
otherwise objectionable. 487
(ii)
The Use Limitation Principle
The Use Limitation principle provides that personal data should not be disclosed, made
available or otherwise used for purposes other than those specified. It provides two
exceptions where this does not apply, i.e. where the individual has permitted the use; and
when such use or disclosure occurs with the authority of law. The intention of providing these
two exceptions is to allow some level of flexibility of use within processing activities. 488 The
underlying logic of the use limitation and purpose specification principles is that of data
485 Article 29 Data Protection Working Party, ‗Opinion 03/2013 on purpose limitation‘, European Commission
(2 April 2013) available at: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf,
(last accessed 24 October 2017).
486 OECD, ‗OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data‘ (2013),
available
at:
http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.ht
m (last accessed 31 October 2017).
487 Article 29 Data Protection Working Party, ‗Opinion 03/2013 on purpose limitation‘, European Commission
(2 April 2013) available at: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2013/wp203_en.pdf,
(last accessed 24 October 2017).
488 OECD, ‗OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data‘ (2013),
available
at:
http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.ht
m (last accessed 31 October 2017).
105