Under GDPR Art. 6(4), can an online shop reuse order data collected for fulfilment to build sales analytics without a new basis?

## Purpose limitation is the starting point The GDPR's **purpose limitation** principle, `Art. 5(1)(b)`, requires personal data to be *collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes*. It does not freeze data to its first use; it forbids **incompatible** further use. An online shop collects order data (items, quantities, delivery address, timestamps) to fulfil orders, a purpose resting on `Art. 6(1)(b)`. The business now wants to reuse the order history to build sales analytics: demand by region, seasonal trends, stock planning. ## Three routes to further processing `Art. 6(4)` sets out when the controller must run a compatibility assessment: | Route | Condition | |---|---| | **Consent** | The data subject consents to the new purpose; compatibility is then not assessed | | **Law** | A Union or Member State law that is a necessary and proportionate measure to safeguard the `Art. 23(1)` objectives | | **Compatibility** | Otherwise, the controller assesses whether the new purpose is compatible with the original | ## The compatibility factors `Art. 6(4)` lists factors to take into account, *inter alia*: 1. **(a) Link** between the original purposes and the intended further purposes. 2. **(b) Context** of collection, in particular the relationship between data subjects and the controller. 3. **(c) Nature** of the data, in particular whether special categories (`Art. 9`) or criminal-offence data (`Art. 10`) are processed. 4. **(d) Possible consequences** of the further processing for data subjects. 5. **(e) Appropriate safeguards**, which may include encryption or pseudonymisation. Recital 50 adds the **reasonable expectations** of data subjects based on their relationship with the controller as part of the context factor. ## Applying the factors to sales analytics - **Link:** strong. Analysing what sold where is closely tied to the selling that produced the data. - **Context:** customers of a shop would reasonably expect it to analyse its own sales. - **Nature:** ordinary purchase data; the assessment changes if the catalogue reveals health conditions or religious practice, since purchases can reveal special-category data. - **Consequences:** aggregate reports about products and regions have little effect on any individual. - **Safeguards:** pseudonymising customer identifiers in the analytics store and restricting access reduce risk further. On these facts the further processing is likely compatible. Recital 50 says that in that case *no legal basis separate from that which allowed the collection of the personal data is required*. ## The statistical-purposes presumption `Art. 5(1)(b)` itself provides that further processing for **statistical purposes** shall, in accordance with `Art. 89(1)`, *not be considered to be incompatible* with the initial purposes. Recital 162 describes statistical purposes as producing statistical results that are **aggregate data**, not personal data, and that are *not used in support of measures or decisions regarding any particular natural person*. `Art. 89(1)` requires appropriate safeguards, in particular for data minimisation, and says that where purposes can be fulfilled without identifying data subjects, they should be. Aggregate demand reporting can fit that description. It does **not** fit analysis whose output is used to decide how to treat a particular customer. ## Where the answer changes The same order history reused for **individual targeting**, such as personalised offers or price differentiation, fails the Recital 162 description and scores differently on the factors: - the **consequences** for each customer are direct; - **reasonable expectations** are weaker for some uses than for others; - a separate basis analysis is prudent, and `Art. 21(2)` gives an unconditional right to object to direct marketing. ## What the controller must still do Compatibility is not a silent licence: - **Inform before processing.** `Art. 13(3)` requires the controller to give data subjects information on the new purpose *prior to* the further processing. - **Record it.** `Art. 5(2)` accountability means the compatibility assessment should be documented. - **Keep the principles.** Minimisation, storage limitation and security apply to the analytics store as to any other. ## Common mistakes - Believing every new use needs fresh consent. - Believing the original basis covers any later use of the same data. - Treating "analytics" as one purpose, when aggregate statistics and individual targeting score very differently. - Skipping the notice under `Art. 13(3)`.