18.

Limitation of purpose and extent

An organisation may collect, use or disclose personal data about an individual only for purposes —
(a) that a reasonable person would consider appropriate in the circumstances; and
(b) that the individual has been informed of under section 20, if applicable.