The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 No. 3141

PART 4 Data Protection in relation to Police and Judicial Cooperation in Criminal Matters

CHAPTER 2 Duties of competent authorities and rights of data subjects

Principles of lawfulness, proportionality and purpose

30.—(1) Personal data must be—

(a) processed lawfully;

(b) collected only for specified, explicit and legitimate purposes;

(c) processed only for the purposes for which the data were collected;

(d) adequate, relevant and not excessive in relation to the purposes for which they were collected.

(2) Further processing of personal data may only be undertaken—

(a) for historical, statistical or scientific purposes, if the relevant conditions are complied with;

(b) for any other purpose, if—

(i) the processing is not incompatible with the purposes for which the data were collected;

(ii) the competent authority is permitted by law to carry it out; and

(iii) the processing is necessary and proportionate to that other purpose.

(3) When undertaking further processing for historical, statistical or scientific purposes, consideration must be given to whether the purpose can be achieved by making the data anonymous.