What is the purpose limitation principle (Zweckbindung) in data processing, and how do you determine if processing is lawful?
Personal data may only be processed for the purpose stated at collection, apparent from the circumstances, or prescribed by law.
* The Zweckbindung lawfulness test — any one lawful-purpose condition plus actual use for that purpose; a change of purpose requires fresh consent. *
The purpose limitation principle (Zweckbindung) is one of the core pillars of data protection. The Swiss DSG requires that personal data be processed only for the purpose that was stated when the data was collected, is apparent from the circumstances, or is legally prescribed.
The three-part test for lawful processing:
- Is the use of data prescribed by law? OR
- Is the type of use apparent from the circumstances? OR
- Was a purpose stated when the data was collected?
If any of these is YES, and the data is actually used for that purpose, the processing is lawful.
If the purpose changes, a new legal basis or fresh consent from the affected person must be obtained before the data may be used for the new purpose.
Practical example: A hospital collects your data for treatment purposes. They cannot simply reuse that same data for research or billing optimization without either getting your new consent or having a separate legal basis. Medical data collected for treatment stays bound to that treatment purpose.