Purpose of processing change
Are you planning to process data for a new purpose? Do you want to use data you already have?
To find out whether this is possible, you must assess compatibility of the new processing purpose with the original purpose (Article 6(4) GDPR). Use our tool to evaluate that quickly and efficiently.
Disclaimer
The compatibility test tool follows the approach proposed by the Article 29 Working Party in Opinion 03/2013 on purpose limitation ( https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2013/wp203_en.pdf).
Each processing operation is individual and may require assessments our tool does not cover. The final result indicates the likelihood of purpose compatibility. This is a supporting, educational tool; explanations in the tool are not legal advice.
The test result must not be the sole basis for decisions by any entity or person using the tool at their own risk. ODO 24 sp. z o.o. is not liable to any entity or person for any direct or indirect consequences of using the tool, including damages, compensation, administrative fines, loss of profits, or other negative consequences.
Compatibility test - questions and answers
What is the purpose limitation principle?
The purpose limitation principle (Article 5(1)(b) RODO) is a central principle of personal data processing. On the one hand it indicates that we may collect data only for specific, explicit and legally justified purposes, and on the other, that such data are not further processed in a manner incompatible with those purposes.
Can I further process data for a purpose other than the one for which they were collected?
The purpose limitation principle provides that a new purpose must not be incompatible with the original one. It is therefore necessary to assess that compatibility (a compatibility test) before commencing processing. Only a positive result from our assessment will permit further processing.
Is the compatibility test mandatory?
Recital 50 RODO indicates that processing data for purposes other than those for which they were collected may be carried out "only in cases where it is compatible with the purposes for which the personal data were originally collected". Opinion 3/2013 on purpose limitation (WP 203) however points to situations where compatibility is obvious, e.g. a future purpose was indicated in the information clause at the time of data collection. In such cases performing and documenting the test is not mandatory.
We do not have to carry out a compatibility assessment if we obtain consent for processing for the new purpose or if processing for the new purpose is a legal obligation or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Similarly, further processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, is covered under Article 89 RODO.
What does it mean that a purpose is not compatible with the original purpose?
An incompatible purpose is one that would not be consistent with the reasonable expectations of the data subject. In understanding the concept of compatibility the factors indicated in Article 6(4) and Recital 50 RODO are helpful. A compatible purpose is one that is related to the original purpose, arises from the relationship between the controller and the data subject, the data are limited and adequate, processing for the new purpose does not materially worsen the individual's position, and additional measures have been implemented to mitigate the risks associated with the new purpose.
What should be done if the new purpose is not compatible with the original purpose?
Processing for a purpose incompatible with the previous one is not permitted. In such situations one cannot assume that a separate purpose is involved and circumvent the prohibition on an incompatible purpose by invoking the legal bases under Article 6(1) RODO.
A negative test result may, however, prompt a re-evaluation of the entire planned processing operation. In that case it is possible to remove the factors that cause the test result to be negative.
