A team skips a further-processing compatibility assessment because the new use sits in the ‘same database’ as the original collection. Is that reasoning sound under purpose limitation?
Select an answer to reveal the explanation.
Short Explanation
Same filing cabinet does not mean same job. Purpose limitation cares about why you collected the data and whether the new use fits—not which server shelf they share. Skipping the compatibility check because ‘it is already in the database’ is wishful thinking.
Full Explanation
Compatible further processing requires assessment of purposes, context, nature of the data, consequences for data subjects, and appropriate safeguards—not mere co-location in the same database. Skipping a further-processing compatibility assessment because the new use sits in the “same database” as the original collection is unsound under purpose limitation. Shared storage is an IT architecture fact, not a legal finding that any new purpose is compatible with the old one.
Shared storage does not always make any further use compatible by definition. Once data enter a municipal database, purpose limitation still applies to each new processing purpose. No assessment is excused merely because a processor’s logo appears on the server rack or because engineers find the fields convenient.
Exam caveat: same database ≠ automatic compatible further processing—a frequent scenario trap. Operational check: run a documented compatibility assessment (or obtain a fresh lawful basis and updated notice), minimise fields for the new use, add safeguards, and record the decision for accountability. City data lakes should not become purpose-free zones; residents trust that each new use is judged, not assumed from folder proximity or shared infrastructure.