Schedule 5 inserts a new Annex 2 into the UK GDPR, which sets out the conditions referred to in new Article 8A(3)(d). If further processing meets any of these conditions, the processing is to be treated as compatible with the original purpose. The conditions do not require that the processing be otherwise authorised in legislation or through a rule of law. Where the original lawful basis for processing was consent (Article 6(1)(a) UK GDPR), use of the conditions in the Annex is subject to consideration by the controller of whether it would be reasonable to seek the data subject’s consent (Article 8A(4)(b)).
	Paragraph 1 treats further processing as compatible where it is necessary for the purposes of making a disclosure to a controller ("A") who needs to process that data for its task in the public interest or exercise of official authority, pursuant to Article 6(1)(e), in circumstances where controller A has made a request for the personal data. Paragraph 1 enables a controller ("B") to respond to such a request from controller A without having to consider whether the new purpose is compatible with the purpose at the point of data collection. Controller B must not be a public authority carrying out processing in performance of its tasks.
	Paragraph 2 treats further processing as compatible when it is necessary for the purpose of making a disclosure of personal data for the purpose of archiving in the public interest. Some organisations may have originally collected personal data under the consent lawful ground for their own purposes, e.g. commercial purposes, without at the time realising its future historical value to an archive. This provision will enable such organisations to disclose the data to a controller ("R"), provided that R makes the request that states they intend to only process the personal data for the purpose of archiving in the public interest; that the disclosure is carried out in accordance with the provisions in Article 84B; and that the personal data in question was collected by the disclosing controller under the consent lawful ground. The controller making the disclosure must also reasonably believe that R will process the data in accordance with generally recognised standards that are relevant to R’s work of archiving in the public interest.
	Paragraph 3 treats further processing as compatible where it is necessary for the purposes of protecting public security. National security and defence purposes are not included in Annex 2 as there is already an exemption from the purpose limitation principle in section 26 of the DPA 2018.
	Paragraphs 4 and 5 treat further processing as compatible where it is necessary for responding to an emergency as defined in the Civil Contingencies Act 2004. This condition will be relevant where there is an event or situation which threatens serious damage to human welfare or the environment in the whole, a part or a region of the UK, or war or terrorism which threatens serious damage to the security of the UK. The Civil Contingencies Act 2004 lists a series of events that further define the meaning of these events or situations, including loss of human life, human illness or injury, homelessness etc.
	Paragraph 6 treats further processing as compatible where it is necessary for the purposes of detecting, investigating or preventing crime or apprehending or prosecuting offenders. The reference to ‘crime’ would also cover economic crimes such as fraud, money-laundering, terrorist financing etc.
	Paragraph 7 treats further processing as compatible where it is necessary for the purposes of protecting the vital interests of the data subject or another individual.
	Paragraph 8 treats further processing as compatible where the processing is necessary for the purposes of safeguarding a child or adult who is over 18 and considered to be at risk in ways defined in paragraph 10.
	Paragraph 11 treats further processing as compatible where processing is carried out for the purpose of assessment or collection of a tax or duty or an imposition of a similar nature.
	Paragraph 12 treats further processing as compatible where processing is necessary for the purposes of complying with an obligation of a controller under an enactment, a rule of law or an order of a court or tribunal.
Schedules Schedule 5: Purpose Limitation: processing to be treated as compatible with original purpose