Common Position Of EU Data Protection Authorities On The Limitation Of Purposes For Personal Data Processing

"Neither too general so as to be meaningless, nor too specific so as to be overly rigid"

On 2 April 2013, the Article 29 Working Party ("WP"), an advisory body composed of representatives of the European Commission, the EU data protection supervisor and the data protection authorities of all EU Member States, issued Opinion 03/2013 on Purpose Limitation ("Opinion"). The Opinion seeks to clarify the purpose limitation principle of Article 6(1)(b) of Data Protection Directive 95/46/EC ("DPD") which, with a view to protecting data subjects from unexpected and excessive processing, sets a limit on the processing that a data controller may carry out in relation to personal data collected. The principle dictates that the purposes of the processing must be "specified, explicit and legitimate" and that any further processing cannot take place "in a way incompatible with those purposes".