29/09/2026
Information collected for one purpose should not automatically be used for a completely different program simply because the organization already possesses it.
𝗡𝗣𝗖 𝗔𝗱𝘃𝗶𝘀𝗼𝗿𝘆 𝗢𝗽𝗶𝗻𝗶𝗼𝗻 𝗡𝗼. 𝟮𝟬𝟮𝟲-𝟬𝟬𝟲 𝗲𝘅𝗮𝗺𝗶𝗻𝗲𝗱 𝘁𝗵𝗲 𝗽𝗿𝗼𝗰𝗲𝘀𝘀𝗶𝗻𝗴 𝗼𝗳 𝗰𝗼𝗻𝗰𝗲𝘀𝘀𝗶𝗼𝗻𝗮𝗿𝘆 𝗯𝗲𝗲𝗽 𝗰𝗮𝗿𝗱𝗵𝗼𝗹𝗱𝗲𝗿 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗗𝗲𝗽𝗮𝗿𝘁𝗺𝗲𝗻𝘁 𝗼𝗳 𝗧𝗿𝗮𝗻𝘀𝗽𝗼𝗿𝘁𝗮𝘁𝗶𝗼𝗻’𝘀 𝗯𝗲𝗲𝗽𝟱 𝗶𝗻𝘀𝘂𝗿𝗮𝗻𝗰𝗲-𝗯𝗲𝗻𝗲𝗳𝗶𝘁 𝗽𝗿𝗼𝗴𝗿𝗮𝗺.
The original information was primarily collected for card applications and system maintenance. The proposed program involved additional processing to identify qualified cardholders, notify them, and facilitate benefit payments.
Although the opinion involved a government program, it offers useful reminders for businesses planning to reuse customer or employee data.
𝟭. 𝗖𝗼𝗻𝗳𝗶𝗿𝗺 𝘁𝗵𝗲 𝗹𝗮𝘄𝗳𝘂𝗹 𝗯𝗮𝘀𝗶𝘀 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗻𝗲𝘄 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝘆
Before using existing information for another purpose, determine which lawful basis supports the proposed processing.
Consent is not always required, but an organization must establish another applicable basis when it does not rely on consent. The proper basis will depend on the organization, the information involved, the purpose, and the relevant legal requirements.
The NPC also explained that a general contractual clause allowing future features or services does not automatically establish that every new use of personal data is necessary to perform the original contract.
𝟮. 𝗥𝗲𝘃𝗶𝗲𝘄 𝘁𝗵𝗲 𝘀𝗰𝗼𝗽𝗲 𝗼𝗳 𝗼𝘂𝘁𝘀𝗼𝘂𝗿𝗰𝗶𝗻𝗴 𝗮𝗴𝗿𝗲𝗲𝗺𝗲𝗻𝘁
A service provider acting as a Personal Information Processor must follow the documented instructions of the Personal Information Controller.
If an existing outsourcing agreement covers only the original service, the controller should amend the agreement, provide supplemental instructions, or prepare appropriate documentation before directing the processor to perform additional activities.
A processor that uses personal data beyond the controller’s authorized purpose may assume the responsibilities of a controller.
𝟯. 𝗗𝗲𝗳𝗶𝗻𝗲 𝘁𝗵𝗲 𝗿𝗼𝗹𝗲 𝗼𝗳 𝗲𝘃𝗲𝗿𝘆 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻 𝗶𝗻𝘃𝗼𝗹𝘃𝗲𝗱
Introducing a new partner can change how responsibilities should be assigned.
Organizations must determine:
¶ Who decides why and how the information ¶ will be processed
¶ Who acts only upon documented instructions
¶ What information each party will receive
¶ Whether subcontractors will be involved
¶ Who will respond to requests, complaints, and security incidents
¶ What happens to the information when the arrangement ends
The label written in a contract is not enough. The parties’ actual activities determine their respective privacy roles.
𝟰. 𝗜𝗻𝗳𝗼𝗿𝗺 𝘁𝗵𝗲 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱 𝗶𝗻𝗱𝗶𝘃𝗶𝗱𝘂𝗮𝗹𝘀
When personal data will be used for a new purpose or disclosed to additional recipients, the privacy notice may need to be updated.
The notice should clearly explain the new activity, including the information involved, purpose and lawful basis, recipients, processing method, retention period, responsible organization, and available data-subject rights.
Where processing has already started, affected individuals should receive the necessary supplemental information at the earliest practicable opportunity.
𝟱. 𝗖𝗼𝗹𝗹𝗲𝗰𝘁 𝗮𝗻𝗱 𝘂𝘀𝗲 𝗼𝗻𝗹𝘆 𝘄𝗵𝗮𝘁 𝘁𝗵𝗲 𝗽𝗿𝗼𝗴𝗿𝗮𝗺 𝗻𝗲𝗲𝗱𝘀
A beneficial purpose does not justify unlimited processing.
The information used must remain adequate, relevant, and necessary for the declared activity. Organizations should avoid collecting additional details when the intended result can reasonably be achieved using less information or a less intrusive method.
Reassess privacy and security risks
A new service may introduce new recipients, systems, disclosures, access arrangements, and security risks.
The organization should conduct or update its Privacy Impact Assessment and ensure that appropriate organizational, physical, and technical security measures cover the expanded activity.
The practical lesson is straightforward:
𝗕𝗲𝗳𝗼𝗿𝗲 𝘂𝘀𝗶𝗻𝗴 𝗲𝘅𝗶𝘀𝘁𝗶𝗻𝗴 𝗰𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗼𝗿 𝗲𝗺𝗽𝗹𝗼𝘆𝗲𝗲 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝗮 𝗻𝗲𝘄 𝘀𝗲𝗿𝘃𝗶𝗰𝗲, 𝗯𝗲𝗻𝗲𝗳𝗶𝘁, 𝗽𝗮𝗿𝘁𝗻𝗲𝗿𝘀𝗵𝗶𝗽, 𝗼𝗿 𝗽𝗿𝗼𝗺𝗼𝘁𝗶𝗼𝗻𝗮𝗹 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝘆, 𝗰𝗼𝗻𝗱𝘂𝗰𝘁 𝗮 𝗳𝗿𝗲𝘀𝗵 𝗽𝗿𝗶𝘃𝗮𝗰𝘆 𝗿𝗲𝘃𝗶𝗲𝘄.
KAT-C Data Privacy Business and Consulting can assist your organization in assessing lawful processing, defining controller and processor responsibilities, reviewing outsourcing provisions, updating privacy notices, and documenting the necessary compliance measures.
Contact KAT-C Business and Data Privacy Consulting Inc. Visit www.katcdataprivacy.com or email us at [email protected]
