“Purpose Specification Principle

9. The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.

Use Limitation Principle

10. Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with Paragraph 9 except:

* a) with the consent of the data subject; or
* b) by the authority of law.”

Another example is the Privacy Principle in the SMART Campaign’s Client Protection Principles which states:

“Privacy of Client Data. The privacy of individual client data will be respected in accordance with the laws and regulations of individual jurisdictions, and such data cannot be used for other purposes without the express permission of the client (while recognizing that providers of financial services can play an important role in helping clients achieve the benefits of establishing credit histories).”

The extent to which such principles apply in a particular case will, of course, depend on local law and any relevant industry standards and codes of conduct have been adopted by the institution concerned.

The bottom line is that the applicability of data protection principles should be front of mind before any decision is made to cross sell.