Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Paragraph 2.3.1  Purpose limitation principle

15. International agreements need to specify the purposes for which personal data is to be transferred and processed including compatible purposes for further processing, as well as to ensure that the data will not be further processed for incompatible purposes. It is recommended, for better clarity, that the specific purposes for the processing and transferring of the data are listed in the international agreement itself.

16. To avoid any risk of a “function creep”, such agreements should also specify that transferred data cannot be used for any purpose other than those expressly mentioned in the agreement, except as set out in the paragraph below.

17. If both parties to the international agreement wish to allow the receiving public body to make another compatible use of the transmitted personal data, further use by the receiving public body shall only be permitted if compatible with the original one and previously notified to the transferring public body which may oppose for specific reasons.