Define The Purposes For Which Your Information Can Be Used

The 2nd principle of the Data Protection Act states:

'Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.'

Failure to adhere to this principle risks separating the content of the information in question with the management and governance rules which have been agreed as being suitable for it. When dealing with personal data this could well damage the interests of the data subject (an identifiable living individual who is the subject of personal data) and in turn the reputation and legal standing of the organisation responsible. Without clarity regarding why that information was obtained, what it is to be used for and by whom, it is all too easy for it to be inadvertently reused in a way in which the data subject may not be comfortable with or which damages their interests. For example, an individual who gave information in confidence as part of a research project suddenly finding themselves publicly associated with those views.

But it is not just in relation to personal data that such issues need to be considered. The almost boundless potential to reuse information has been one of the defining characteristics of information technology in recent years. In the vast majority of cases the outcomes of such reuse will be positive and are to be encouraged. This could be the embedding of a digital photograph within the university website, the aggregation of existing statistics to undertake fresh analysis or making use of the content from a previous project proposal as part of a new initiative.

What is important is for there to be active and deliberate consideration as to whether any of the management controls associated with the original information either prevents or limits its potential reuse, or needs to be transferred to the new resource. For example, do the intellectual property rights associated with the digital photograph allow for it to be reused on your website? Does it contain images of individuals whose consent might be required? Will the credit for the picture be correctly associated to the original photographer or mistakenly attributed to the person responsible for scanning and manipulating it?

In order to achieve this, it is necessary not only to have defined what management controls are required for the information being created for its original purpose, but also to identify whether there are likely to be any issues associated with its reuse in the future. If not, great; but if so it is better to consider these issues in advance - or at least to flag that there may be issues to be addressed if and when this occurs in the future.

The issues raised in this section help demonstrate the intrinsic link between information and the processes which both create and rely upon it which is a recurrent theme throughout this infoKit.