The purpose limitation of the use of Artificial Intelligence is often overlooked at an operational level

The purpose limitation principle, more specifically, is rooted in the Organisation for Economic Co-operation and Development’s guidelines on privacy and in the Convention 108, and is considered to comprise two subprinciples, the purpose specification and the compatible use limitation or compatibility principles. Similarly stipulated in EU law, the purpose limitation principle guarantees that personal data must be processed for predefined specified purposes and not further processed in a manner that is incompatible with those purposes, unless under exceptional circumstances. The principle, embedded in theories of informational self-determination, allows for the individual to obtain control over their personal data, albeit individual control in the law enforcement environment has been arguably contested as unrealistic. The purpose limitation principle is said to offer a balanced approach between the reasonable expectations of individuals, by enhancing trust and legal certainty, and certain competing interests, by acknowledging the pragmatic need for further processing in specific occasions.

Finally, the function of purpose within EU human rights case law is similarly elusive. In cases of surveillance, the Court of Justice of the EU, for instance, tends to assimilate the presence of a general purpose of security to the presence of an objective of general interest, despite the enshrinement of purpose specification principle within the Charter of Fundamental Rights of the EU (CFREU), as part of the right to data protection. However, this approach renders the purpose limitation principle, in essence, useless; the examination of the existence of an objective of general interest would have been performed regardless, in accordance with the CFREU, during the assessment of any non-absolute right. The purpose limitation principle is moreover often overlooked at an operational level without concrete measures taken to enforce it. Contrary to the spirit of the principle described above, the mere existence of a law enforcement objective is often equated to compliance with the purpose limitation principle. A seemingly narrower approach is followed, where each individual part of the principle, i.e. purpose specification, compatibility, and its restriction under the condition of necessity and proportionality, are not fully taken into consideration. The lack of such examination facilitates this imperceptible re-purposing of an AI system, which creates room for function creep.