The second data protection principle is that information must be obtained only for a specified purpose, and must then be dealt with in a way that is compatible with that purpose.
The individual should have been notified of the purpose for which the information was to be held when it was first obtained, under the first data protection principle (fair processing information).
This principle means, for example, that an employer that has obtained an employee's home address for the purpose of personnel administration should not then use that address for marketing purposes.