Section 36 The second data protection principleI1

(1)

The second data protection principle is that—

(a)

the law enforcement purpose for which personal data is collected F1(whether from the data subject or otherwise) must be specified, explicit and legitimate, and

(b)

personal data so collected must not be processed F2by or on behalf of a controller in a manner that is incompatible with the purpose for which F3the controller collected it.

(2)

Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3)

Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—

(a)

the controller is authorised by law to process the data for the other purpose, and

(b)

the processing is necessary and proportionate to that other purpose.

(4)

Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

Annotations

Textual amendments

F1: Words in s. 36(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(a), 142(1); S.I. 2026/82, reg. 2(d)
F2: Words in s. 36(1)(b) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(b)(i), 142(1); S.I. 2026/82, reg. 2(d)
F3: Words in s. 36(1)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 71(8)(b)(ii), 142(1); S.I. 2026/82, reg. 2(d)

Commencement

I1: S. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)