Data Protection - Staff Handbook
8. Second Principle - Purposes for holding Data
8.1 Personal data shall be obtained only for one or more specified and lawful purposes and shall not be processed in any manner incompatible with that purpose or those purposes.
8.2 This principle covers the identification of the purposes for which data is processed and the restriction of processing to those purposes.
8.3 The University makes use of fairly general definitions of purpose in collecting data, eg for academic purposes, for employment purposes etc. However, it is important to note that such data can only be processed for those explicit purposes. Data therefore cannot be passed to another office within the University if it is to be used for a purpose other than that originally notified to the data subject. For example, data collected for accommodation purposes cannot be subsequently used for financial purposes unless both purposes were identified at the time of the original collection of the data.
If data is required to be processed for any purpose other than the original one, the data subject must be notified before processing can take place. This is particularly important for schools that, for their own purposes, might make use of data collected by central services. It is also vital in the case of data obtained from outside the University, for example the names and addresses of external contacts, as this data cannot be passed on to another office within the University which would use it for a different purpose. For example, contact details held by the Accommodation Office for accommodation purposes cannot be passed to the Alumni Office for fund-raising purposes.