white_paper_on_data_protection_in_india_171127_final_v2

minimisation, or the practice of limiting the collection of personal information to that which
is necessary to accomplish a specified purpose. 489
5.2 Issues
(i)
Relevance of the Purpose Specification Principle in light of technological developments
The advent of newer technologies such as Big Data, data analytics and the Internet of Things
may challenge the relevance of the purpose limitation principle, as it currently exists. Various
applications of these technologies have demonstrated that many potentially valuable and
innovative uses of data develop outside of the scope of the purpose specified at the time of
data collection. Data may be repurposed and used in an entirely different manner, which has
nothing to do with the original purpose. 490 Similarly, the Internet of Things functions by
collecting and storing a large amount of data first, which is then analysed to translate into an
immensely beneficial service the purpose of which was not even conceptualised at the time of
collection. 491 However, it could be argued that even for such services, the purposes that the
services may be put to could be envisaged and set out for the data subject to review. If the
purposes get changed in the future, the data subject may be notified as and when such
amendments are made.
(ii)
Compatibility Assessment
Assessing whether a particular use of information is compatible with the original purpose is
difficult. Data is often multi-functional and it may not be possible to definitively determine
whether a particular use of data falls within a permitted purpose. On the other hand, if a more
subjective compatibility test is prescribed, this would involve weighing factors such as the
nexus between the original use and the current use; the context in which the information was
collected, whether the use was reasonable; the nature of information collected and the impact
of further processing. This may prove burdensome to the data controller, or to the data
protection authority, depending on who must assess compatibility. This leads to another issue
of who is responsible for determining compatibility.
(iii) Difficulty in specifying purpose in a simple manner
The purpose specification principle is intended to ensure that the purpose for which
information is collected is clear and specific. In actual practice, personal data could be
489 Bernard Marr, ‗Why Data Minimisation is an important concept in the age of Big Data‘, Forbes (16 March
2016), available at: https://www.forbes.com/sites/bernardmarr/2016/03/16/why-data-minimization-is-animportant-concept-in-the-age-of-big-data/#58dbc0aa1da4,
(last accessed 24 October 2017).
490 Omer Tene and Jules Polonetsky, ‗Big Data for All: Privacy and User Control in the Age of Analytics‘, 11(5)
Northwestern Journal of Technology and Intellectual Property 239 (2013), available at:
http://scholarlycommons.law.northwestern.edu/cgi/viewcontent.cgi?article=1191&context=njtip, (last accessed
24 October 2017).
491 Office of the Privacy Commissioner of Canada, ‗Discussion Paper on Consent and Privacy‘ (May 2016),
available
at: https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacyresearch/2016/consent_201605/#heading-0-0-7,
(last accessed 20 November 2017).
106