Section 15

An organisation may collect, use or disclose personal data about an individual -

{a} only for purposes that a reasonable person would consider appropriate in the circumstances; and

(b} that are relevant and limited to what are reasonably necessary for its purposes.