Data Protection Commissioner
Data Protection Commissioner

Data Protection Rule 3

Use and further processing of personal information

"the data shall not be further processed in any manner incompatible with that purpose or those purposes"
- section 2(1)(c)(ii) of the Act

If you obtain peronal information for a particular purpose, you may not use the data for any other purpose, and you may not divulge the personal data to a third party, except in ways that are "compatible" with the specified purpose. A key test of compatibility is whether you use and disclose the data in a way in which those who supplied the information would expect it to be used and disclosed.

Note that transfers of personal data to agents of yours, who are carrying out operations upon the data on your behalf and not retaining it for their own purposes, do not constitute "disclosures" of data for the purposes of the Act. (See the definitions section for the formal definition of "disclosure".) Examples of such transfers would include the transfer of staff data to a separate payroll company for payroll administration purposes, and the transfer of personal data from a general practitioner to a clinical laboratory for analysis of tissue samples. You should also note that, even though such transfers would not involve "disclosure" of personal data, the data controller might also have to consider whether the data have been "fairly obtained" for these purposes.

The restriction on processing of personal data (including disclosure to a third party) is lifted in a limited number of circumstances, specified in section 8 of the Data Protection Acts, where the right to privacy must be balanced against other needs of civil society, or where the processing is in the interests of the individual.

LINK» more about disclosures permitted under section 8 of the Act

Use and Disclosure: Test Yourself

You should be able to answer YES to the following questions:-

  • Do you use the data only in ways consistent with the purpose or purposes for which they are kept?
  • Do you disclose the data only in ways consistent with that purpose or purposes?

Practical steps

Carry out an inventory of all current and proposed disclosures and check each one against the stated purposes.

Some Case Studies relevant to this topic:

The following Case Studies, which have appeared in Annual reports of the Data Protection Commissioner over recent years, may be of some interest. Click on the Case Study details to see the full text.

CASE STUDIES - Disclosure



MENU Select Page No.
<- Previous    Next ->