Part 3: Law enforcement processing Chapter 2: Principles Section 36: The second data protection principle
The second principle (section 36) requires personal data to be processed for specific, explicit and legitimate law enforcement purposes, namely for one or more of the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and the prevention of threats to public security. The personal data is permitted to be processed for a different law enforcement purpose than that initially processed for so long as it is a lawful purpose, proportionate and necessary. So, for example, the Crown Prosecution Service could process personal data in connection with the prosecution of a criminal offence, whereas the police working alongside the prosecutor would be processing the personal data in connection with the investigation of the offence.