Section 87 — Data Protection Act 2018: The second data protection principle

The second data protection principle 87 1 The second data protection principle is that—

a the purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and b personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it .

2 Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

3 Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—

a the controller is authorised by law to process the data for that purpose, and b the processing is necessary and proportionate to that other purpose.

4 Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—

a consists of—

i processing for archiving purposes in the public interest, ii processing for the purposes of scientific or historical research, or iii processing for statistical purposes, and b is subject to appropriate safeguards for the rights and freedoms of the data subject.