s 18 Limitation of purpose and extent
18. An organisation may collect, use or disclose personal data about an individual only for purposes —(a) that a reasonable person would consider appropriate in the circumstances; and (b) that the individual has been informed of under section 20, if applicable.