Data Protection Commissioner
Data Protection Commissioner

Data Protection Rule 2

Specifying the Purpose

You may not keep information about people unless it is held for a specific, lawful and clearly stated purpose. It is therefore unlawful to collect information about people routinely and indiscriminately, without having a sound, clear and legitimate purpose for so doing.

"the data shall have been obtained only for one or more specified explicit and legitimate purposes"
- section 2(1)(c)(i) of the Act

 

Data controllers who are required to register with the Data Protection Commissioner include in their register entry a statement of their purpose for holding personal data. If such data controllers keep or use personal data for any purpose other than the specified purpose, they may be guilty of an offence.

Having A Specified Purpose: Test Yourself

You should be able to answer YES to the following questions:-

  • Do you specify the purpose for which you are collecting and keeping personal information?
  • Is that purpose lawful?
  • Can you make a precise statement of that purpose?
  • Has the purpose been made known to those for whom, and about whom, you keep personal data?
  • Have you made out a list of the different sets of data which you keep and the specific purpose of each?

Practical steps
Prepare a statement of the purpose or purposes for which you hold information about others. Any individual has the right to ask you to state the purposes for which you keep such information. If you have not already done so, you should also prepare the list referred to in the final question.

  

Some Case Studies relevant to this topic:

CASE STUDIES - Further Processing
 
MENU Select Page No.
<- Previous    Next ->