A city collected festival ticket emails solely for entry control, then reuses them to build a political-donation lookalike model without a compatible further-processing analysis. Which processing principle is primarily at risk?
Select an answer to reveal the explanation.
Short Explanation
You bought a festival ticket so the door staff could let you in—not so City Hall could model your politics. Purpose limitation is that handshake: collect for a clear job, do not silently pivot to an incompatible one. Entry-control emails into a donation lookalike is a classic purpose drift.
Full Explanation
Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Collecting festival ticket emails solely for entry control, then reusing them to build a political-donation lookalike model without a compatible further-processing analysis, primarily risks purpose limitation—and often lawfulness and fairness as well. New, sensitive political profiling is not a trivial adjacent use of an entry list.
Storage limitation alone is not the primary principle here, and email addresses do not expire after twenty-four hours by law. Integrity and confidentiality are not the lead issue merely because lookalike models “never involve personal data”—they typically do. Portability does not forbid any civic email list under all circumstances; it is a different right.
Exam caveat: further processing needs a compatibility assessment (or a fresh basis)—shared inbox ≠ new purpose licence. Operational check: document original purposes, run compatibility analysis or obtain a new valid basis and notice, minimise political inferences, and block silent reuse. Municipal event teams should treat resident emails as entrusted for the stated civic purpose, recording why a donation-lookalike pivot was rejected as incompatible with public trust.