Section 71 sets out the conditions for determining whether the reuse of personal data (otherwise known as "further processing") is permitted in compliance with the purpose limitation principle outlined in Article 5(1)(b) of the UK GDPR. This principle prohibits further processing that is not compatible with the original purpose for which the personal data was collected.
	The conditions are made by way of a series of amendments to the UK GDPR (subsection (1)).
	Subsection (2) amends Article 5(1)(b) of the UK GDPR. It includes a clarification that the rules around further processing apply to personal data collected from a data subject or from a third party. This means that if one controller shares personal data with another, the controller disclosing the data may be conducting further processing but the controller receiving the personal data for the first time is not regarded as conducting further processing.
	Subsection (3) clarifies that meeting a condition under Article 8A for further processing does not permit controllers to continue relying on the same lawful basis under Article 6(1) that they relied on for their original purpose if that basis is no longer valid for the new purpose. However, the work undergone for satisfying the conditions under the new Article 8A may assist controllers with establishing a basis under Article 6(1) for the new purpose.
	Subsection (4) removes Article 6(4) from the UK GDPR, since the provisions for further processing have now been set out in the new Article 8A.
	Subsection (5) inserts a new Article 8A into the UK GDPR in order to set out the conditions under which further processing of personal data complies with the purpose limitation principle in Article 5(1)(b) of the UK GDPR.
	New Article 8A(2) sets out factors which must be considered when evaluating whether processing is compatible with its original purpose. Factors to be taken into account include any link with the original processing and the effects on the data subject.
	New Article 8A(3) lists the circumstances in which a purpose is to be treated as compatible with the controller’s original purpose. If one of these circumstances applies, the controller does not need to evaluate compatibility under Article 8A(2). The list of circumstances are:
When a data subject has given fresh consent for the new purpose (Article 8A(3)(a));
When the processing is for research (historical and scientific), archiving in the public interest or statistical purposes (Article 8A(3)(b)) and is carried out in accordance with Article 84B UK GDPR;
When the processing of personal data is carried out for the purposes of ensuring that it complies with Article 5(1) of the UK GDPR, or demonstrating that it does (Article 8A(3)(c)). For example, if a controller is seeking to pseudonymise personal data (and
this was not anticipated or notified at the point of data collection), then this is permitted through Article 8A(3)(c). Pseudonymisation or other data security measures will be compatible through Article 8A(2) in most cases, or will have been signalled at the point of collection. However, where the original lawful basis for the collection of personal data was consent, the compatibility route would not be available.
When the controller’s purpose is among the purposes outlined in Annex 2 UK GDPR (Article 8A(3)(d)); or
Where the processing is necessary to safeguard an interest in Articles 23(1)(c) to (j) (for example, important objectives of public interest, in particular an important economic or financial interest of the UK, including monetary, budgetary and taxation matters, public health and social security (Article 23(1)(e)) and is authorised by legislation or a rule of law (Article 8A(3)(e)).
	New Article 8A(4) outlines the additional restrictions placed on further processing of personal data that was originally collected on the basis of consent (through Article 6(1)(a) UK GDPR). Further processing of such data is only permitted in four circumstances (and the final two can only be relied upon in situations where the controller cannot reasonably be expected to obtain the data subject’s consent):
If fresh consent is sought and obtained under Article 8A(3)(a);
If the processing is carried out for the purposes of ensuring that processing of personal data complies with Article 5(1) of the UK GDPR, or demonstrating that it does;
If the processing meets a condition in Annex 2 (see Article 8A(3)(d)); or
If it is necessary to meet a safeguard in Articles 23(1)(c) to (j) and is authorised by an enactment or a rule of law (see Article 8A(3)(e)).
	The Secretary of State has the power under new Article 8A(5) to amend the list of conditions in Annex 2 that are to be treated as compatible with the original purpose. The power enables the Secretary to add to or vary the conditions or omit conditions added by regulations. Any conditions added to the Annex by primary legislation cannot be removed through use of this power. Pursuant to Article 8A(6), a new condition can only be added to Annex 2 where it meets one of the important public interest objectives outlined in Article 23(1)(c)-(j) UK GDPR. Article 8A(7) sets out ways in which regulations can identify processing. The power is subject to the affirmative procedure by virtue of new Article 8A(8).
	Subsection (6) of section 71 introduces Schedule 5, which inserts new Annex 2 into the UK GDPR.
	Subsections (7) to (9) make amendments equivalent to those made to Article 5(1)(b) UK GDPR by section 71 (2) to sections 36(1) and 87(1) of the DPA 2018. These sections set out the purpose limitation rules for law enforcement processing (section 36(1)) and for Intelligence Services processing (section 87(1)). The amendments clarify that the rules around further processing apply to personal data collected from a data subject or otherwise by the controller or a processor currently processing that data.
	Subsection (10) removes the purpose limitation limb of paragraph 5(1)(b) from the definition of "the listed GDPR provisions" in Part 1 of Schedule 2 to the DPA 2018 as the exemptions from the purpose limitation in that Part have now been added to new Annex 2 to the UK GDPR by virtue of Schedule 5.
Part 5: Data Protection and Privacy Data protection principles Section 71: The purpose limitation