It's difficult to come up with a one-size-fits-all, but I do like the necessity approach. It has to be reasonably necessary for a legitimate operating program of the government institution to collect it in the first instance, and obviously that's the purpose that informs the use to which it can be put. You don't necessarily want to bake it in too much, but you do for the private sector. The private sector has to identify the purposes to the individuals, obtain their informed consent, and if they want to use it for any other purpose than the one that they've informed the person about, they have to go back and get consent.
On September 29th, 2016. See this statement in context.