If you meet the criteria to apply the journalism exemption, you no longer have to comply with the requirement to use personal information for a specified purpose. This section of the code sets out what the legislation says and how to comply when you are not applying the exemption (See Apply the journalism exemption).
What does the legislation say?
8.1 You must use personal information for a specified purpose that is legitimate and clear. If you want to use it for a different purpose, this must be compatible with your original purpose.
How do we comply?
8.2 This data protection principle is closely linked to other principles. As long as you comply with the other principles, you are unlikely to need to do anything more to comply.
8.3 You can use personal information for a new purpose if it is in line with your original purpose. For example, keeping personal information for a news archive is still using it for journalism because this is part of the end-to-end process.
8.4 If you are not sure whether using the information for another purpose is compatible, factors you should consider include:
- any link between the original and new purpose;
- how you collected the personal information and people’s reasonable expectations;
- the nature of the personal information and any harm; and
- how you will keep the personal information safe.
8.5 It is not likely to be compatible if you are using personal information for a purpose that is very different, unexpected, or which would have an unjustified impact on people. However, you can consider whether the person would consent (see Use personal information lawfully).
8.6 You should regularly review how you use personal information to check that your purposes have not changed over time.
Reference notes
These reference notes support the Data protection and journalism code of practice (the code) but are not part of the statutory code itself.
Key legal provisions
UK GDPR article 5(1)(b) – the purpose limitation principle
UK GDPR article 6(4) – determining compatibility
UK GDPR article 30 – requirement to record the purposes of the processing