Purpose Limitation
Art. 5(1)(b) GDPR — data only for the original purpose
TL;DR
Personal data may only be used for the purposes originally specified. A change of purpose (Art. 6(4)) is permissible only under strict conditions.
What is purpose limitation?
Practical examples of a change of purpose:
- Original: newsletter sign-up — new: marketing call
- Original: job application — new: talent pool for other positions
- Original: customer contact — new: use for AI training
All three are changes of purpose — a new legal basis is required (typically consent).
Example from practice
An insurer collects health data in order to process applications. Using that data to assess motor insurance tariffs, as planned, is a change of purpose — separate consent is required.
Frequently asked questions
When is a change of purpose permissible?
Art. 6(4): where it is compatible with the original purpose (compatibility test), or on the basis of fresh consent, or on a statutory basis.
Does AI training count as a change of purpose?
Yes, as a rule. The CNIL and the BSI confirm that AI training is a purpose in its own right.
Fine?
Art. 83(5)(a) — up to EUR 20 million or 4%.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, please consult an admitted lawy