white_paper_on_data_protection_in_india_171127_final_v2

equired, could mitigate this situation. Further, incompatible purposes, irrespective of
how beneficial they may be to the user may not be permitted for further processing.
4. The use limitation principle may need to be modified on the basis of a contextual
understanding of purposes and uses. This is captured by the reasonableness standard,
i.e. a subsequent use is permitted as long as a reasonable individual could reasonably
expect such use. This may be further developed by sectoral regulators.
5.5 Questions
1. What are your views on the relevance of purpose specification and use limitation
principles?
2. How can the purpose specification and use limitation principles be modified to
accommodate the advent of new technologies?
3. What is the test to determine whether a subsequent use of data is reasonably related to/
compatible with the initial purpose? Who is to make such determination?
4. What should the role of sectoral regulators be in the process of explicating standards for
compliance with the law in relation to purpose specification and use limitation?
Alternatives:
a. The sectoral regulators may not be given any role and standards may be
determined by the data protection authority.
b. Additional/ higher standards may be prescribed by sectoral regulators over and
above baseline standards prescribed by such data protection authority.
c. No baseline standards will be prescribed by the authority; the determination of
standards is to be left to sectoral regulators.
5. Are there any other considerations with respect to purpose specification and use
limitation principles which have not been explored above?
110