Section 36 — Data Protection Act 2018: The second data protection principle

The second data protection principle 36 1 The second data protection principle is that—

a the law enforcement purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and b personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it .

2 Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

3 Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—

a the controller is authorised by law to process the data for the other purpose, and b the processing is necessary and proportionate to that other purpose.

4 Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.