§ 18 — Limitation of purpose and extent

18. An organisation may collect, use or disclose personal data about an individual only for purposes —(a)

that a reasonable person would consider appropriate in the circumstances; and

(b)

that the individual has been informed of under section 20, if applicable.