79 / 192
Chapter 7
Data Protection Principle 3
The main questions:
• What are the general requirements under DPP3?
• What is a new purpose?
• How is the original purpose of collection ascertained?
• What constitutes the use of personal data for a purpose directly related to the original
purpose of collection?
• Is sale of personal data a directly related purpose of use?
• What constitutes “prescribed consent” of the data subject? Can a person give
prescribed consent on behalf of a data subject?
• How can a data subject’s consent be obtained under the new requirements on direct
marketing?
• Can a data subject withdraw his consent previously given?
The questions of use of personal data discussed in this Chapter concerning DPP3 have been
selected on the basis of their practical importance in light of the Commissioner’s own
experience. Before reading this Chapter, readers should read paragraphs 1.7 to 1.11 in
Chapter 1 —
Introduction, which contain important general information on using this Book.
Importance of DPP3
7.1
DPP3 governs the use of personal data and is of great practical importance and
concern to both the data users and the data subjects. It is also the data protection
principle in relation to which the Commissioner receives the largest number of
complaints.
7.2
Data Protection Principle 3(1) provides as follows:
Principle 3 – use of personal data
(1) Personal data shall not, without the prescribed consent of the data subject, be used for
a new purpose.