Data Management

Topics

1. Purpose
   
2. Lawful grounds

1. Purpose

Once we collect PI for a specified purpose, can we use it for other purposes (secondary use)?

The POPIA does not ban this altogether, but there are restrictions. In essence, if your purposes change over time or you want to use PI for a new purpose which you did not originally anticipate, you can only go ahead if the further processing is in  in accordance or compatible with the purpose for which it was originally collected.

To assess whether further processing is compatible with the purpose of collection, the RP must take account of:

1. the relationship between the purpose of the intended further processing and the purpose for which the information was originally collected (is there any link between your original purpose and the new purpose?)
2. the nature of the information concerned (the nature of the PI – e.g. is it particularly sensitive)
3. the consequences of the intended further processing for the DS
4. the manner in which the information has been collected
5. any contractual rights and obligations between the parties (the context in which you originally collected the PI – in particular, your relationship with the individual and what they would reasonably expect)

As a general rule, if the new purpose is either:

• very different from the original purpose
• would be unexpected to the DS
• would have an unjustified impact on the DS

it is likely to be incompatible with your original purpose. In practice, you are likely to need to ask for specific consent to use or disclose PI for this type of purpose.

Example:

A general practitioner discloses his patient list to his wife, who runs a travel agency, so that she can offer special holiday deals to patients needing recuperation. Disclosing the information for this purpose would be incompatible with the purposes for which it was obtained.

2. Lawful grounds

The further processing of personal information is not incompatible with the purpose of collection if:

1. the DS or a CP where the DS is a child has consented to the further processing of the information
2. the information is available in or derived from a public record
3. the information has deliberately been made public by the DS
4. further processing is necessary:
1. to comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue as defined in section 1 of the South African Revenue Service Act, 1997 (Act No. 34 of 1997)
   
2. for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated
3. in the interests of national security
5. the further processing of the information is necessary to prevent or mitigate a serious and imminent threat to:
1. public health or public safety
2. the life or health of the DS or another individual
6. the information is used for historical, statistical or research purposes and the responsible party ensures that the further processing is carried out solely for such purposes and will not be published in an identifiable form; or
7. the further processing of the information is in accordance with an exemption granted by the IR.