Purpose Limitation
privacyFull Name: Purpose Limitation Principle
Definition
Purpose Limitation is one of the seven core principles of GDPR data processing, established in Article 5(1)(b). It requires that personal data be collected only for specified, explicit, and legitimate purposes and not subsequently processed in a manner that is incompatible with those original purposes. In the EUDI Wallet ecosystem, purpose limitation plays a critical role in ensuring that identity data shared during credential presentations is used only for the declared verification purpose and not repurposed for profiling, marketing, or other secondary uses that the user did not consent to.
Purpose Limitation in the EUDI Wallet Consent Flow
The EUDI Wallet's consent user interface is designed to make purpose limitation transparent and enforceable. When a relying party initiates a credential verification request, the request includes a machine-readable purpose declaration specifying why the data is needed. The wallet presents this information to the user in clear, understandable language before any data is shared. Users can review exactly what data is being requested, who is requesting it, and for what specific purpose.
The OpenID4VP (Verifiable Presentations) protocol used by EUDI Wallets supports purpose-bound requests where the verifier must declare the legal basis and specific purpose for each requested attribute. A hotel checking in a guest might request name and nationality for registration purposes, while a liquor store might request only an age-over-18 confirmation for age verification purposes. The wallet ensures that the data shared matches the declared purpose, refusing to provide unnecessary attributes.
Transaction logs maintained within the wallet provide users with a history of what data they shared, with whom, and for what purpose. This transparency mechanism allows users to audit their own data sharing activities and identify any instances where they believe their data might have been misused. These logs can also serve as evidence in data protection complaints or enforcement proceedings.
Technical Enforcement Mechanisms
While purpose limitation has traditionally been enforced primarily through legal and contractual means, the EUDI Wallet introduces technical mechanisms that strengthen enforcement. Selective disclosure ensures that verifiers receive only the data attributes relevant to their declared purpose, making it technically impossible for them to access data they did not request. If a bar only needs age verification, the wallet only provides the age confirmation, making it impossible for the bar to also obtain the user's address or full name.
Cryptographic purpose binding can attach the declared purpose to the shared data in a tamper-proof manner. The presentation token generated by the wallet can include a hash of the purpose declaration, meaning the data is cryptographically tied to the stated purpose. Any attempt to claim the data was shared for a different purpose can be disproven by examining the cryptographic evidence.
Time-limited data sharing is another technical mechanism supporting purpose limitation. The EUDI Wallet can configure credential presentations with expiration times, after which the shared data should be deleted by the relying party. While deletion cannot be technically enforced after data leaves the wallet, the time limitation creates a clear contractual and legal obligation that supports purpose limitation enforcement.
Regulatory Context and Enforcement
GDPR provides a well-established enforcement framework for purpose limitation violations. Data protection authorities across EU member states have the power to investigate complaints, conduct audits, and impose substantial fines for purpose limitation breaches. The combination of GDPR enforcement with the eIDAS 2.0 supervision framework creates a complete oversight system for the EUDI Wallet ecosystem.
The eIDAS 2.0 regulation adds specific requirements for relying parties who accept EUDI Wallet credentials. They must register their intended use cases and declare the purposes for which they will request credential data. This registration creates an additional layer of accountability beyond GDPR, as member state authorities can verify that relying parties' actual data requests match their registered purposes.
The European Data Protection Board has issued guidance clarifying that the purpose limitation principle requires a case-by-case assessment of compatibility between the original collection purpose and any proposed secondary use. For EUDI Wallet data, this means that even if a verifier has a legitimate relationship with the user, they cannot repurpose identity data received during credential verification for marketing, analytics, or any other purpose not explicitly declared at the time of the data request.