The second data protection principle is that—
the purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and
personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it.
Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—
the controller is authorised by law to process the data for that purpose, and
the processing is necessary and proportionate to that other purpose.
Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—
consists of—
processing for archiving purposes in the public interest,
processing for the purposes of scientific or historical research, or
processing for statistical purposes, and
is subject to appropriate safeguards for the rights and freedoms of the data subject.