(50) The processing of personal data for purposes other than those for which the data were originally collected should be permitted only in cases where it is compatible with the purposes for which the personal data were originally collected. In such a case, a separate legal basis other than the legal basis that enabled the collection of personal data is not required. If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union law or Member State law may define and specify the tasks and purposes for which further processing should be considered lawful and compatible with the original purposes. Further processing for archival purposes in the public interest, scientific or historical research, or statistical purposes should be considered as processing operations that are lawful and compatible with the original purposes. The legal basis for the processing of personal data provided by Union or Member State law may also be the legal basis for further processing. In order to determine whether the purpose of the further processing of personal data is compatible with the purpose for which the data were originally collected, the controller - once all the requirements for the lawfulness of the original processing have been met - should take into account, among other things: any links between those purposes and the purposes of the intended further processing; the context in which the personal data were collected, in particular reasonable grounds for data subjects to expect further use of the data based on the nature of their relationship with the controller; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of adequate safeguards during both the original and intended further processing operations. If the data subject has given his or her consent, or if the processing is based on Union or Member State law that constitutes a necessary and proportionate measure in a democratic society that ensures, in particular, the achievement of important objectives of general public interest, the controller should be able to carry out further processing of personal data, regardless of its compatibility with the original purposes. In any case, it should be ensured that the principles provided for in this Regulation are applied, in particular the application of the principle of informing the data subject of these other purposes and of his or her rights, including the right to object. The identification by the controller of possible criminal acts or threats to public safety and the transmission in an individual case - or in different cases related to the same criminal act or threat to public safety - of the relevant personal data to the competent authority should be considered the fulfillment of the controller's legitimate interest. However, such transmission in the legitimate interest of the administrator or further processing of personal data should be prohibited if it is incompatible with a legal, professional or other binding obligation of secrecy.
„We are a small company; only large players receive penalties."
Are you sure about that?

