Processing is lawful if at least 1 legal justifications applies.
Data subject has given consent for processing or
Processing is necessary (for performance of contract, legal compliance, vital interest, in public interest, controller’s legitimate interest)
Difficulties regarding processing for new purpose.
Controller shall ascertain compatibility between new purpose and original purpose
If impossible to ascertain compatibility with original purpose, controller needs:
- fresh consent or
- legal obligation