The radical reframing of the purpose limitation principle – Why the Dutch delegation uprooted data protection

This chapter argues that the EU General Data Protection Regulation (GDPR) radically reframed one of the corner stones of data protection: the purpose limitation principle. In short, the purpose limitation principle provides that personal data are not further processed in a manner that is incompatible with the purposes it was originally collected for. Under the Directive 95/46/EC (DPD) regime (supported by a wider regime of fundamental rights and case law), purpose limitation was considered the main rule, and exceptions were to be interpreted restrictively, thus only allowed on an individual and incidental basis. The GDPR (specifically Article 6(4)) has altered (or attempted to alter) this regime by changing the legal framework for purpose limitation, by allowing public administrative bodies to make collective and permanent exceptions to the purpose limitation principle, thus turning the exception into the rule. The chapter is divided in two sections. The first section provides a broad analysis of the purpose limitation principle, its functions, the restrictive interpretation, and the GDPR reframing. The second section establishes the connection between the relevant legislative amendments introduced in the GDPR and the Dutch 'big data' legislations known as the SyRI legislation and the WGS proposal.