Article 5(1)(b) of the GDPR states that personal data must be "collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes." Based…

Question

Options

• AIt dictates the level of security a processor must follow when using and storing personal data for
• BIt guides the courts on the severity of the consequences for those who are convicted of the
• CIt sets the standard for the level of detail a controller must record when documenting the purpose
• DIt indicates the degree of flexibility a controller has in using personal data in ways that may vary

• A
  12% (7)
• B
  21% (12)
• C
  5% (3)
• D
  62% (36)

Explanation

The purpose limitation principle requires that personal data be collected for specified, explicit and legitimate purposes and not be further processed in a manner that is incompatible with those purposes. However, the GDPR does not provide a clear definition of what constitutes an incompatible purpose. Instead, it leaves room for interpretation by the member states, taking into account the context and circumstances of the processing. This means that the degree of flexibility a controller has in using personal data for a new purpose may vary depending on the member state's law and guidance. Some factors that may affect the compatibility assessment include the link between the original and the new purpose, the expectations of the data subject, the nature of the data, the impact of the further processing, and the safeguards applied by the controller.

No community discussion yet for this question.