(3) A person who retains records for historical, statistical or research
purposes shall ensure that the records that contain the personal data are
adequately protected against access or use for unauthorised purposes.
(4) A person who uses a record of the personal data of a data subject to make
a decision about the data subject shall
(a) retain the record for a period required or prescribed by law or a code
of conduct, or
(b) where there is no law or code of conduct that provides for the
retention period, retain the record for a period which will afford the
data subject an opportunity to request access to the record.
(5) A data controller shall destroy or delete a record of personal data or
de-identify the record at the expiry of the retention period.
(6) The destruction or deletion of a record of personal data shall be done
in a manner that prevents its reconstruction in an intelligible form.
Further processing to be compatible with purpose of collection
25. (1) Where a data controller holds personal data collected in con- nection
with a specific purpose, further processing of the personal data shall be for that
specific purpose.
(2) A person who processes data shall take into account
(a) the relationship between the purpose of the intended further
processing and the purpose for which the data was collected,
(b) the nature of the data concerned,
(c) the manner in which the data has been collected,
(d) the consequences that the further processing is likely to have for the
data subject, and
(e) the contractual rights and obligations between the data subject
and the person who processes the data.
(3) The further processing of data is considered to be compatible with
the purpose of collection where
(a) the data subject consents to the further processing of the
information,
(b) the data is publicly available or has been made public by the person
concerned,
(c) further processing is necessary
(i) for the prevention, detection, investigation, prosecution or punishment for an offence or breach of law, (ii) for
the enforcement of a law which imposes a pecuniary penalty,
(iii) for the enforcement of legislation that concerns pro- tection
of revenue collection,
(iv) for the conduct of proceedings before any court or tribunal