The end of the purpose-specification principle in data protection?

Abstract

The ‘purpose specification principle’, that is, the principle that a citizen needs to be informed why the personal data is being collected and the specific purposes for which it will be processed and kept, is a central protection for a citizen in data protection law. Data sharing practices using personal data collected for one purpose for another purpose are on the increase with clear prejudice to the purpose specification principle. While initially, at law, data sharing was limited to instances where the purpose for which the personal information is used is not incompatible to the purpose for which the same information was collected, there seems to be a trend to extend instances of data sharing with clear disregard to the purpose-specification principle. This paper documents the proposal and withdrawal of two legislative initiatives (the introduction of data sharing provisions in the Coroners’ and Justice Bill 2009 and the Communications Data Bill 2008) to determine whether a clear pattern to end the purpose-specification principle in data protection in the UK is emerging or whether it has in fact seen its end already. The paper argues that while the withdrawal of these legislative initiatives is a positive step even if perhaps instigated by political opportunism, the systematic erosion of the purpose-specification principle will unfortunately continue to increase the possibility of abuse of citizens’ rights.