Personal Data (Privacy) Ordinance
A Guide For Data Users No. 3
Outline Action Plan For Complying with the Data Protection Principles

ACTION 2 - Limit the Use of Personal Data

Data Protection Principle 3 - use of personal data

• Review whether the personal data you hold are only used (which includes disclosed or transferred) for the purposes identified at Step 2 under Action 1 above for which they were to be used at the time of collection, or for a directly related purpose.
  
  
• If you are using personal data for a different purpose, check whether the data subjects concerned have given consent for this change of use. To be effective, such consent must be express and given voluntarily. If such consent has not been given, you must either obtain it or stop using the data for the purpose concerned.