THE LEGISLATION MUST INCLUDE PURPOSE LIMITATION
(I.E. THE REQUIREMENT THAT DATA COLLECTED FOR
ONE PURPOSE CANNOT BE USED FOR ANOTHER)
One of the most important things we have to do in any federal privacy legislation is to prevent the acquisition of location data if such collection is not central to the function of the original service. To this end, a key principle of the General Data Protection Regulation is purpose limitation. Purpose limitation means that data collected for one purpose cannot be used for another.
*The following is taken directly from the Information Commissioner's Office website.
The Purpose Limitation Principle says: Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes. Therefore,
You must be clear about what your purposes for processing are from the start.
You need to record your purposes as part of your documentation obligations and specify them in your privacy information for individuals.
You can only use the personal data for a new purpose if either this is compatible with your original purpose, you get consent, or you have a clear obligation or function set out in law.