Title: .A.3. THE PURPOSE SPECIFICATION PRINCIPLE (FINALITY PRINCIPLE)

Article 6.1.b. states that personal data must be “collected for specified, explicit and legitimate purposes and may not [be] further processed in a way incompatible with those purposes.”

But article 6.1.b. continues: “Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards”.

These safeguards “must in particular rule out the use of the data in support of measures or decisions regarding any particular individual” (considerans 29). Considerans 26 states, “the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable”.

This seems to imply that the data collector is not obliged to specify the profiling purpose in case of anonymised data. However, several situations can be anticipated:  

1. If the data are collected anonymously from the beginning (the data can not be linked anymore with an identifiable natural person), data protection law seems not to apply, so the data collector is not obliged to specify the profiling purpose.  

2. If the data are not collected anonymously (the data can be linked with an identifiable person), data protection law applies (definition of personal data). 

Four different situations can indeed occur: 

1. The personal data of identifiable persons are collected for profiling purposes only and they are not made anonymous. 

2. The personal data of identifiable persons are collected for profiling purposes only and they are made anonymous. 

3. The personal data of identifiable persons are collected in first instance for other purposes and they are afterwards also used for profiling purposes, and they were not made anonymous. 

4. The personal data of identifiable persons are collected in first instance for other purposes and they are afterwards also used to construct profiles, and they were made anonymous.  

Case (1) seems to imply that the purpose has to be specified because data collection is taking place only for the purpose of profiling. Restrictively interpreted, article 6.1.b.only applies to “further processing of data for historical, statistical or scientific purposes”. When the only purpose of the data collection is statistical, there is no situation of “further” processing of personal data.

In the second case the situation is more complex because we are confronted with considerans 26 stating, “that the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable”. One could argue that the purpose has to be specified for two reasons: First, article 6.1.b.only applies to “further processing of data for historical, statistical or scientific purposes” and second, the purpose specification principle does not apply from the moment that the data are rendered anonymous. In other words, it does apply at the moment of collection.

In situation (3) we also think that the profiling purpose has to be specified when reading article 6.1.b. in combination with considerans 29: “Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards whereas these safeguards must in particular rule out the use of the data in support of measures or decisions regarding any particular individual”. When the statistics are profiles and these profiles are used as group profiles, they can be used to support measures or decisions regarding any particular individual. The word “any” particular individual is of importance, because group profiles do apply to any individual, belonging to a group. When my data are used to build group profiles and the group profile is applied to another individual, one could speak of a measure or decision regarding any particular individual.

Also in situation (4), the purpose has to be specified for the same reasons as in situation (3).

We can conclude that the purpose of constructing group profiles does not have to be specified when no personal data are collected. If personal data are collected and they are used for profiling purposes, this purpose has to be specified in as far as it aims for more than just statistics: as soon as it supports measures and decisions towards at least one particular individual the purpose of profiling should be specified. We would like to note that, even if the purpose of profiling has to be specified, the purposes are often too broadly or not understandably described in the general terms and conditions of the service provider. Also, an effective control on the principle of finality, e.g. by supervisory authorities, does not really exist. Another problem is that most of the time the data subject does not know what data is being processed, whether legally or illegally. In that case one cannot expect the data subject to claim that his data have been collected and processed for purposes that are incompatible with the Directive.