On 2nd April 2013, the Article  29 Working Party published Opinion 03/2013 (WP 203) on the ‘purpose limitation’ principle in the Data Protection Directive (95/46/EC) (‘the Opinion’). In one of its most important pieces of work, the Working Party analyses the two main components of the purpose limitation principle, namely purpose specification and compatible use. As the Working Party itself acknowledges, the purpose limitation principle goes to the heart of data protection law and is relevant to all data controllers processing personal data in the EU. It sets the limits of fair processing of data that may be conducted by data controllers and seems to provide transparency and certainty about the nature of processing. 

Purpose specification 

The first aspect of the purpose limitation principle provides that personal data must only be collected for ‘specified, explicit and legitimate purposes’ (Article 6 (1)(b) of the Data Protection Directive (95/46/EC)). This lies at the core of the legal framework and is a pre-requisite condition for the processing of personal data, leading to all the other processing requirements — adequacy, relevancy and proportionality of data (Article 6(1)(c)), accuracy and completeness (Article 6(1)(d)) and data retention (Article 6(1)). Focusing on purpose specification in further detail, the Working Party offers the following guidance as to the meaning of ‘specified, explicit and legitimate purposes’. 

Specified purpose: The purpose of any processing must be sufficiently and clearly defined to determine its scope and to enable appropriate safeguards to be implemented. Such specification must occur prior to, and in any event no later than, the time of data collection. The appropriate level of detail will depend on the particular context in which data are collected and the nature of the personal data.