Limitation of purpose and extent
18.  An organisation may collect, use or disclose personal data about an individual only for purposes —
(a)that a reasonable person would consider appropriate in the circumstances; and
(b)that the individual has been informed of under section 20, if applicable.