The principle of purpose limitation, a cornerstone of data protection law, mandates that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. In a post-liquidation asset acquisition, processing data for tax, pension, or employment benefits is a continuation of the original, necessary purposes based on legal and contractual obligations. However, using the data for "analytical purposes" constitutes a new purpose. The acquiring company, as the new data controller, must establish a new, valid legal basis for this new processing activity. Given that this purpose is not a legal requirement or essential for a contract with the data subject, obtaining separate, explicit consent is the appropriate legal basis.

A. Retaining data for tax purposes is a legal obligation, which serves as a valid legal basis for processing without requiring new consent.
C. Ensuring pension payments is necessary to fulfill ongoing contractual and legal obligations to former employees, not a new processing purpose.
D. Securing employment benefits is a continuation of the contractual and legal duties stemming from the original employment relationship. ---

1. General Data Protection Regulation (GDPR)

Regulation (EU) 2016/679.

Article 5(1)(b): Establishes the "purpose limitation" principle

stating data shall be "collected for specified

explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes."

Article 6(4): Outlines the conditions for assessing whether a new processing purpose is compatible with the original purpose. Processing for analytics by a new entity is unlikely to be considered compatible

thus requiring a new legal basis from Article 6(1)

such as consent.

2. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (2nd ed.). IAPP (International Association of Privacy Professionals).

Chapter 5: The Privacy Operational Life Cycle: This chapter discusses the importance of purpose limitation throughout the data lifecycle. In the context of a merger or acquisition (an event that changes data controllership)

the text emphasizes that the acquiring entity must re-evaluate the legal basis for processing. Using data for a new purpose

such as analytics

would require establishing a new legal basis

often necessitating fresh consent from the data subjects.

3. Article 29 Data Protection Working Party. (2013). Opinion 03/2013 on purpose limitation (WP203).

Section III.2.b

"Change of purpose": This opinion clarifies that when data is processed for a new purpose

a full compatibility assessment is required. It states

"Where the further processing is considered to be for an incompatible purpose

it can only be legitimate if it is based on the data subject's consent or a provision of Union or Member State law." Using employee data for analytics post-acquisition would be a clear change of purpose requiring such a new legal basis.