Chapter III - Protecting the Patient through Purpose Limitation

Summary

Introduction – “The purpose limitation principle protects data subjects by setting limits on how data controllers can use their data while also offering some degree of flexibility for data controllers”, this is how the Article 29 Working Party introduced its Opinion on the purpose limitation principle under the 95/46 Data Protection Directive in 2013. In its essence, the purpose limitation principle thus intends to prevent data from being collected for broad or unspecified purposes. It forces data controllers to determine the purpose of the data processing before initiating the data collection. It is one of the golden rules in data protection law: personal data can only be processed for a specific, explicit and legitimate purpose. The purpose limitation principle has long been recognised as a cornerstone principle for protecting the fundamental rights to privacy and data protection. It is embedded in Article 8 of the European Convention on Human Rights (ECHR), in the Council of Europe's Convention 108 (CoE Convention 108) and the Organisation for Economic Co-operation and Development (OECD) Guidelines on data protection. Across the Atlantic, it is one of the traditional fundamental aspects of the Fair Information Practice Principles, for example. When considering the value the principle has been attributed with historically, one can only confirm its crucial role in European data protection law. The Article 29 Working Party described the purpose limitation principle as the “essential first step in applying data protection laws and designing data protection safeguards”. Cavoukian, a former Canadian data protection Commissioner, is long advocating in favour of the purpose limitation principle. She summarises the essence of the principle as follows: “[p]urposes are the basis for setting and evaluating limits on collection and use of personal information, and for determining necessity and proportionality”.

The why – The purpose limitation principle asks about ‘the why’ of data processing operations. The principle's goal is to ensure data controllers carefully think about the implications of their intended data processing activities. Data controllers must carefully specify why they wish to collect or otherwise process data and what data they need to achieve the goal they aim to achieve.