PROCESSING FOR SPECIFIED PURPOSES (THE SECOND DATA PROTECTION PRINCIPLE)
The second data protection principle says that:
|
Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. |
The second data protection principle is clearly aiming at transparency in that it requires the data controller to inform the data subject prior to the commencement of processing of the specific purpose for the processing. Paragraph 5 of the interpretation identifies two methods for the giving of the information needed to satisfy the second data protection principle:
|
5. The purpose or purposes for which personal data are obtained may in particular be specified – (a) in a notice given for the purposes of paragraph 2 by the data controller to the data subject, or (b) in a notification given to the Commissioner under Part III of this Act. |
The first method is to specify the processing purpose in the ‘notice’ given by the data controller for the purpose of supplying the data subject with the prescribed information required by paragraph 2(3) of the interpretation. This method is appropriate because the prescribed information includes ‘the purpose or purposes for which the data are intended to be processed’. However, as has already been explained, the obligation to supply the prescribed information does not arise where the data subject already has it, or where one of the exemptions applies.
If the data controller is not obliged to supply the prescribed information (because the data subject already has it or because of an exemption) then it may choose to specify the processing purpose in a notification to the Information Commissioner. The data controller could, if it wished, choose to serve a notice on the data subject despite the fact that none is required for compliance with the fairness part of the first data protection principle. This is because of the use of the word ‘may’ in the wording of paragraph 5 of the interpretation; the methods set out in 5(a) and (b) are possible methods for specifying the processing purpose, but they are not the only methods.