What are the purposes of personal data processing?

Any company that processes personal data must determine the purposes of the processing, since this determines the categories of data that the company can collect. It is also impossible to obtain user consent for processing without goals. Therefore, when prescribing the Privacy Policy, one of the points will be the purposes of processing. You can read about how to correctly determine them in our article.

Contents: 

• Why indicate the purpose of processing personal data? 
• How to determine the purposes of personal data processing
• Destruction of personal data after achieving the goals of their processing

Why indicate the purpose of processing personal data? 

In accordance with the Law "On Personal Data" (hereinafter FZ-152), you need to obtain the consent of the person to process personal data (hereinafter referred to as PD). When obtaining consent, you must indicate the purposes of PD processing. In other words, consent cannot be obtained without a specific purpose. Therefore, when drawing up a Privacy Policy and drawing up a mechanism on the site for obtaining consent, you need to think over the goals in advance.

The second case when you come across processing goals is the processing itself. It should happen in accordance with predetermined goals, i.e., you cannot get more data than you need. If your goals differ depending on the subjects of PD, it is necessary to create separate databases. When concluding a loan agreement, the bank asked to indicate the citizen of the persons living with him, as well as minor children. For this he received an order from the authorized body. The court sided with the citizen and indicated that this information does not correspond to the purposes of PD processing, since they are not a party to the loan agreement (А76-5164 / 2016).

When the purposes of processing cease to be relevant, the data must be anonymized or deleted. 

Similar regulation exists in European law. In accordance with Art. 6 of the European Regulation (hereinafter - GDPR), the processing of information is considered lawful if

• consent is given for one or more specific purposes;
• the processing is necessary for a legitimate interest pursued by the operator or a third party;
• other conditions are met. 

However, one way or another, a goal is determined at all points and a target criterion is present, i.e., in the event of a discrepancy between the purpose and the amount of PD, the processing will be declared illegal.

How to determine the purposes of personal data processing 

The purposes of processing depend on:

• Actual activity. This is a key parameter, since the company receives the PD that it needs to carry out its activities. For example, an online store responsible for delivering a product cannot but ask for the address to which the product needs to be delivered. Therefore, in order to prescribe goals, you need to understand what PD is used for;
• Functions that the law assigns to a company that carries out such activities. 
• Business processes, which may differ depending on the structural divisions and groups of PD subjects. 

Destruction of personal data after the implementation of the processing goals

Destruction of PD also refers to the processing process. Destruction suggests that it will be impossible to restore the content in the future. The company is obliged to destroy them:

• If PD from the subject was obtained illegally or is not needed for predetermined processing purposes. This is often found in contracts with consumers, where he does not have the ability to influence the content of the terms of the contract (contract of adhesion). Courts force companies to delete certain data (А76-5164 / 2016);
• After reaching the goal of PD processing;
• If there is a revocation of consent by the subject of PD.

Thus, the purposes of PD processing must be specific, legal and predetermined. To determine them, you need to understand what data you need for your actual activities. Probably, without some data, it will be impossible to provide services. But an unjustified expansion of the list of goals may entail liability for violation of legislation in this area. If you have any questions or you need help with the preparation of the Privacy Policy, please contact A4 Law Firm lawyers.