The purpose and limitations of purpose limitation

Abstract

This thesis is the most comprehensive study into the role of the purpose limitation principle in European data protection law and fundamental rights law. The study discusses the two components of the purpose limitation principle separately: the purpose specification requirement and the non-incompatibility requirement. This study zooms in on purpose limitation in relation to the right to privacy, the right to protection of personal data, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Law Enforcement Directive (LED, DPDP, (EU) 2016/680), and the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data CETS No. 108. This study includes the case law of the European Court on Human Rights (ECtHR) on article 8 European Convention on Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) on article 7 and 8 of the Charter of Fundamental Rights of the European Union (CFREU). The author concludes that there is a hierarchy in data protection principles and that the purpose specification requirement belongs to the essence of the right to protection of personal data. This requirement plays a central role in the protection of personal data in Europe. The non-incompatibility requirement, on the other hand, is just one of the many forms of use limitation that are regulated in the European data protection framework. The role of the purpose limitation principle differs highly per component. The research is conducted with a focus on voluntary data sharing between commercial entities and criminal law enforcement agencies in the pre-crime phase of criminal law enforcement. This focus gives the study relevance in discussions on data-driven policing, predictive policing and public-private partnerships.