2.3. What are the principles applicable to the processing of personal data? Principles can be understood as general norms embedding values that are particularly important within a legal system.79 The GDPR contains six principles governing the processing of personal data to which controllers are required to adhere. These are:80 1. Lawfulness, fairness and transparency Lawfulness means that there must be a legal basis (or ground) for processing personal data.81 Fairness can be linked to ethical personal data processing, in the sense personal data must be handled in ways have unjustified adverse effects upon them.82 Transparency requires informing the data subjects in clear and plain language as to how their data is being used, and what the risks, rules, safeguards, and rights connected to the processing of personal data are.83 2. Purpose limitation Purpose limitation means that any processing of personal data must be done for a well-defined specific purpose, identified before the beginning
2. Personal data protection basics
that people would reasonably expect, and not used in ways that
of processing. Any further processing must be compatible with the original purpose.84 This is the principle that prevents collection of personal data ‘just in case’, without any outline as to how it will be used.
79
Oxford Bibliographies Online, ‘General Principles of Law’ https://www.oxfordbibliographies.com/view/document/obo-9780199796953/ obo-9780199796953-0063.xml.
80
Article 5 GDPR.
81
Footnote 30, 118.
82
ICO, ‘Principle (a): Lawfulness, fairness and transparency’ https://ico.org.uk/ for-organisations/guide-to-data-protection/guide-to-the-general-dataprotection-regulation-gdpr/principles/lawfulness-fairness-and-transparency/.
83
Footnote 30, 118.
84
Idem, 122.
49
