PART 3Law enforcement processing
CHAPTER 2Principles
36The second data protection principle
1
The second data protection principle is that—
a
the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and
b
personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.
2
Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
3
Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—
a
the controller is authorised by law to process the data for the other purpose, and
b
the processing is necessary and proportionate to that other purpose.
4
Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.