Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b), what is the impact of a member state’s interpretation of the word “incompatible”?

Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b), what is the impact of a member state’s interpretation of the word “incompatible”?
A . It dictates the level of security a processor must follow when using and storing personal data for two different purposes.
B . It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.
C . It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.
D . It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.

View Answer

Answer: D