Purpose limitation
Purpose limitation is the principle in Art. 5(1)(b) GDPR that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. It has two components: purpose specification at the time of collection, communicated to the data subject under Art. 13 and 14, and a compatibility requirement for any subsequent use. The principle derives from the OECD Guidelines and Convention 108 and was analysed in detail in the Article 29 Working Party Opinion 03/2013.
Further processing for a new purpose is permitted if it is compatible, assessed under Art. 6(4) by reference to the link between purposes, the context of collection and reasonable expectations, the nature of the data, the consequences for individuals and the existence of safeguards such as pseudonymisation. Art. 5(1)(b) adds a presumption: further processing for archiving in the public interest, scientific or historical research or statistical purposes is not considered incompatible, provided the Art. 89(1) safeguards are in place. Incompatible new purposes require a fresh legal basis and information.
In life sciences the principle governs whether trial data collected for a specific protocol can be reused for exploratory analyses, pooled databases, model training or secondary research. The EDPB (Opinion 3/2019) cautions that the research presumption is not a blanket licence and that transparency towards participants remains necessary. Describing planned future uses in the informed consent form, adopting tiered or broad consent for samples, and documenting compatibility assessments in the DPIA are the operational answers.
