Provided that the legislature ensures that the further use of data satisfies the specific
constitutional requirements of the principle of purpose limitation, such an approach is
generally constitutionally permissible (1.). On the other hand, the legislature may also
allow a change in purpose. As an authorisation for the use of data for new purposes
this is, however, subject to specific constitutional requirements (2.).
1. The legislature may allow a use of the data beyond the specific procedure of the
data collection as a further use in the context of the original purposes of the data. Insofar, the legislature may invoke the justification underlying the data collection and is
thus not subject to the constitutional requirements applied to a change in purpose.
278
a) The permissible scope of such uses depends on the authorisation for the data
collection. The respective legal basis for interferences determines the competent authority as well as the purpose of and conditions for data collection and thus defines
the permissible scope of use. Accordingly, the principle of purpose limitation that applies with regard to information obtained on the basis of the authorisation is not a restriction to certain abstractly defined functions of the authorities but is determined in
accordance with the scope of the collection purpose stipulated in the relevant legal
basis for the respective case of data collection. For that reason, further use of the data within the scope of the originally determined purpose is only permissible insofar as
it involves the same authority acting within the same assignment of tasks and for the
protection of the same legal interests as were determinant for the data collection. If
this specific permission to collect data is restricted to collection for the purpose of protecting certain legal interests or preventing certain criminal offences, this limits both
its immediate and its further use even by the same authority insofar as there is no other legal basis allowing a further use in the context of a permissible change in purpose.
279
b) Generally, the relevant intervention thresholds required for the collection of data,
such as the traditional thresholds requiring a sufficiently specific risk situation in the
context of the protection against threats or a sufficiently strong suspicion in the context of criminal prosecution, do not belong to the purpose limitations that the same authority must reconsider for each and every further use of data. The requirement of
there being a sufficiently specific risk situation or a qualified suspicion determines the
grounds that may prompt the permission to collect data. Such requirements do not,
however, determine the permissible purposes for which the authority may then use
the data.
280
For that reason, the principle that data must be used in accordance with its original
collection purpose is not automatically contradicted if the further use of such data is
permitted as a mere evidentiary basis for further investigations (Spurenansatz) when
performing the same task, irrespective too of further legal requirements. Insofar, the
authority may use the findings thus obtained – either alone or in combination with all
other available information – as a simple starting point for further investigations to
protect the same legal interests within the same assignment of tasks. This takes into
281
46/71