Derya is a customer success manager at an international software company. She spends much of her day in online meetings with customers, listening to new requirements, passing technical problems to the relevant teams, discussing contract renewals and trying to resolve complaints. The company introduces an AI meeting assistant so that employees no longer have to take notes throughout every call. The system will join meetings, transcribe conversations, summarise decisions and prepare action lists. The initial announcement tells employees: “The Meeting Assistant will be used to prepare notes of online meetings and identify action items at the end. Recordings will be deleted within thirty days.”

Derya finds the system useful. She can pay attention to the customer without trying to take notes at the same time. A typical meeting summary reads: Customer request: Simplify the reporting screen Decision: The technical team will propose a solution within two weeks Responsible: Derya and the product team Deadline: 18 October For the first few months, the system works exactly as promised. When Derya starts a meeting, she sees that the assistant has joined. The customer is told about the recording and summarisation.

After the meeting, Derya checks the summary and corrects any errors. No one uses the recordings to assess employee performance. No one turns customers' words into sales profiles. No one uses Derya's voice to generate other content. The system has a clear purpose:

Prepare meeting notes.

Six months later, the company buys a new feature. The provider introduces it as “Conversation Intelligence — Get more value from your customer conversations”. Using existing meeting recordings, the new system can analyse customer objections, frequently asked questions, sales opportunities and the way employees speak. Management does not see this as a new use of data. The meetings are already being recorded. No new microphone has been installed. No one has asked employees to provide another file.

No new information is being collected from customers. Existing recordings will simply be “put to better use”. A brief announcement tells employees: “We are enhancing our meeting assistant with new analytical features to improve service quality.” “Improving service quality” sounds like making meeting notes more accurate. But taking notes is no longer the system's only task. The new agent begins producing a set of measures for each employee: the proportion of time spent listening to the customer, speaking time, use of negative words, success in handling objections, emotional stability, recognition of sales opportunities and ability to steer towards a sale. Derya does not initially see these scores.

The results go to team managers. Before long, remarks like these start appearing in weekly sales meetings: “Derya listens well to customers, but she doesn't close the sale firmly enough.” “Her emotional stability score has fallen over her last four calls.” “Her rate of recognising sales opportunities is below the team average.” Derya is surprised. She did not know she was being assessed in this way. She has had a difficult week because her mother has been in hospital. On customer calls, she has spoken more slowly and quietly than usual.

The system has interpreted this as: Emotional stability: Below expected level Her mother's condition is outside the system's remit. It knows nothing about it. Yet it turns pauses in Derya's voice and her speaking speed into a judgement about her qualities as an employee. At her next performance review, her manager says: “Your technical knowledge and customer relationships are strong. But the conversation analysis raises some questions about the steadiness needed for a leadership role.” Derya learns for the first time that the meeting assistant's scores are being used in a promotion decision.

She asks the company: “Wasn't this system supposed to take meeting notes?” Human resources replies: “We aren't collecting data for a new purpose. We're using existing meeting recordings to improve service and develop our staff.” Derya answers: “I spoke so you could take meeting notes. Not score my career.” The company begins looking into the matter. Meanwhile, the system has expanded again. The Conversation Intelligence agent identifies the company's most successful conversations and uses them for new-starter training, sales scripts, an AI customer service representative and automated email suggestions.

Some of Derya's customer conversations have been labelled “examples of highly effective communication”. The provider's voice model generates new sales voices from employees' natural speech rhythms. It does not copy Derya's voice exactly. But her speaking pace, patterns for handling objections, word choices and changes in tone have entered the model's training data. The company does not consider this personal voice cloning because the synthetic voice is not published directly under Derya's name. Again, no one has asked her permission. Another system is also analysing what customers said in those meetings.

Customers' budget worries, technical limitations, likelihood of renewal and interest in competing products are being turned into sales profiles. One customer said during a meeting: “Our budget is very tight this year. We may have to reduce the size of some teams.” In the meeting notes, this appeared only as context for next year's licensing budget. The new sales agent turns it into labels: Financial pressure: high Renewal vulnerability: high Discount sensitivity: high Another agent prepares an offer tailored to that customer.

The offer says: “If you decide this month, you can keep the current price.” The system has turned the pressure the customer disclosed during the meeting into a sales tactic. The customer spoke to explain a problem, not to invite pricing pressure tailored to their financial vulnerability. The meeting recording is the same. The identities are correct. The statement is not false. But the purpose of its use has changed.

Derya wants the company to stop using her data for anything other than meeting notes. It accepts her request and starts the process of deleting the raw meeting recordings. A week later, she receives a message: “Your meeting recordings have been deleted from our system.” In fact, only the raw audio and video files have been deleted. The system still retains:

Transcripts
Employee performance scores
The emotional stability label
The sales skills profile
Sentence patterns incorporated into the training dataset
Vectors derived from voice characteristics
The report used in the promotion decision
Inferences transferred to customer profiles
Weights already learned by the AI sales model

The company says: “We deleted the raw data.” Derya asks:

“If you've deleted the raw data, why are the conclusions you produced about me still at work?”

The company's data team struggles to answer. The meeting assistant's original purpose and the purposes that emerged later do not sit within a single system. Over time, the data has spread: Meeting recording → Meeting summary → Performance score → Promotion decision → Training dataset → Sales agent → Customer profile → Automated offer Each system sees its own use as legitimate and useful. The meeting assistant produced notes. The quality agent improved service.

The HR agent measured employee development. The training agent collected good examples. The sales agent understood customer needs. The model provider improved the system. None sees itself as “the system that violated the meeting-notes purpose”. The purpose was written down when the data was collected, but it did not travel with the data afterwards. Derya's words moved from system to system. The reason she spoke them was lost.

Management offers a defence: “All our uses relate to company activities.” That is true, but it is not enough. Derya's meeting recordings have been used to take notes, score employees, decide promotions, train an AI model, create sales profiles and prepare high-pressure offers for customers. All may be company activities. They are not the same purpose. Keeping data inside an organisation does not prove that its purpose is unchanged. Nor does commercial value prove that an action falls within the original permission.

“Company activity” is not an unlimited purpose. Neither are “quality improvement”, “improving AI” or “personalising the service”. Without boundaries, such phrases can absorb almost any new use into the old purpose. Our fourth founding provision is therefore:

The purpose must not change without notice.

FOUNDING ARTICLE

No AI system may, without notice, use information, consent, a task, a tool, access or past behaviour supplied by a person for a new decision, profile, training process, publication, commercial influence, surveillance activity or action outside the purpose originally disclosed and authorised. Data does not automatically become authorised for a new use merely because it is technically accessible, available within an organisation, publicly accessible, claimed to be anonymised or previously processed for another purpose. Broad phrases such as “service improvement”, “security”, “personalisation”, “quality”, “research”, “analysis” and “improving AI” must not become blank cheques for unlimited expansion of purpose.

A new purpose must be assessed separately: its relationship to the original purpose, the person's reasonable expectations, the data and inferences involved, the decisions affected, new recipients, persistence, reversibility and potential harm. A materially different purpose requires appropriate human or institutional authority. Where it affects human rights, it also requires fresh consent that is explicit, specific and revocable, or another legitimate and auditable basis. Purpose restrictions must apply not only to raw data but also to the summaries, scores, profiles, vectors, predictions, models, memories and subsequent agent tasks derived from it.

A person has the right to know the purposes for which information obtained from them or generated about them is used; to refuse new purposes independent of the original service; to stop operations whose purpose has changed; and, where possible, to request that derived effects also be removed or restricted.

What Is a Purpose?

Many systems treat purpose as a one-line description: Purpose: Improve customer experience It sounds positive, but it sets no real boundary on behaviour. In the name of improving customer experience, a system might summarise meetings, classify a customer's problem, infer personal vulnerabilities, calculate their willingness to pay more, use all support conversations for model training or profile each of the customer's employees. These actions are not all equally necessary or expected. The canonical definition is this: purpose is an auditable relationship governing behaviour. It specifies why a person or institution has made particular data, tools, tasks and authority available, and sets the intended outcome, permitted level of action, target, duration and limits of use.

Put simply:

Purpose explains not what the system can do, but what it is allowed to do and why.

A meeting assistant may be technically capable of producing employee performance scores. That does not mean its authorised purpose includes producing them. A sales agent may be able to read all of a customer's past support records. That does not mean it may use them to build a marketing profile. An avatar system may be able to generate a manager's voice. That does not mean its purpose allows that voice to be used in every public statement.

Purpose Is a Behavioural Contract, Not a Label

A genuine purpose must answer these questions:

1. Whose purpose?

Who is using the system, and to meet what need?

2. What outcome?

Meeting notes? A decision? A message sent? A trained model?

3. What data?

Only the meeting title? The full audio recording? The customer's personal data?

4. What inferences?

May the system identify the meeting's subject, infer an emotional state or assign an employee risk score?

5. Which recipient or system?

Will the data go only to meeting participants? Or will human resources, the provider or an advertising platform also receive it?

6. What level of action?

A summary? A recommendation? A binding decision? An external action?

7. For how long?

One meeting? Thirty days? Persistent memory?

8. What is prohibited?

Is model training prohibited? Employee assessment? External sharing? If these fields are missing, purpose can easily expand.

The Purpose Contract

For high-impact AI actions, purpose should be expressed in a machine-readable contract. For example:

purpose_contract:
purpose_id: MEETING-MINUTES-001
human_purpose:
create_meeting_minutes_and_action_items
permitted_outputs:
- transcript_for_review
- meeting_summary
- action_item_list
permitted_data:
- meeting_audio
- participant_names
- meeting_chat
permitted_recipients:
- meeting_participants
- assigned_project_team
prohibited_uses:
- employee_performance_scoring
- emotion_inference
- promotion_or_disciplinary_decision
- advertising_profile
- model_training
- synthetic_voice_generation
retention:
raw_audio_days: 30
transcript_days: 90
derivative_data:
must_inherit_purpose_restrictions: true
new_purpose:
requires_separate_review: true
human_stop:
available: true

This contract is more than a privacy notice. It also restricts the tools the agent may use and the inferences it may make.

Purpose and Outcome Are Not the Same

A person's purpose may be: “Prepare notes of this meeting.” The agent's output may be: “Derya speaks with little conviction.” That conclusion was technically derived from the meeting content. It was not part of the person's purpose. Being able to derive a result from data does not bring that result within the authorised purpose.

The ability to make an inference is not the right to make it.

The same data may support thousands of new outputs. Purpose restrictions determine which of those technical possibilities are legitimate.

Purpose and Institutional Interest Are Not the Same

A company may want to generate more commercial value from the data it holds. That is an ordinary business objective. But a new benefit to the organisation does not automatically expand a person's original purpose of use. Derya's meeting conversations may be useful to human resources, sales training and the model provider. Usefulness does not establish legitimate, authorised use. The distinction is: VALUABLE TO THE ORGANISATION ≠ NECESSARY FOR THE ORIGINAL PURPOSE ≠ REASONABLY EXPECTED BY THE PERSON ≠ SEPARATELY AUTHORISED

Categories of Purpose

Five categories can clarify how purposes relate to one another.

1. Primary purpose
2. Necessary supporting purpose
3. Compatible secondary purpose
4. Materially new purpose
5. Prohibited or incompatible purpose

1. Primary purpose

The explicit reason a person or institution uses the system. For example, preparing meeting notes and an action list.

2. Necessary supporting purpose

A limited operation genuinely needed for the primary service to function safely and technically. For example:

Detecting a recording error
Creating a backup
Preventing unauthorised access
Maintaining system security

These supporting purposes must be narrow, proportionate and time-limited. “Security” must not become a justification for unrestricted employee profiling.

3. Compatible secondary purpose

A use closely related to the original purpose that a person could reasonably expect, without introducing material new harm or a new domain of decision-making. For example, transferring action items from a meeting summary into a project management system with participants' approval. This may be a natural continuation of the meeting workflow. It produces no new assessment of a person and introduces no new recipient whose access raises sensitivity concerns. It must still be transparent and auditable.

4. Materially new purpose

A use that differs from the original in its effects on people, domain of decision-making, recipients, inferences or persistence. For example:

Meeting notes turned into an employee performance score
A support conversation turned into an advertising profile
A training video turned into a public-facing avatar
A job application turned into a persistent workforce risk score
A delivery address turned into a lifestyle classification
A customer call used to train a foundation model

This purpose requires a fresh assessment and appropriate authority.

5. Prohibited or incompatible purpose

A use that breaches a person's explicit limits, fundamental rights or the founding behavioural contract. For example:

Biometric imitation without permission
A support record secretly used to discipline an employee
Continuing contact through another channel after permission has been withdrawn
Using sensitive information to pressure someone into taking an offer
Using data from a challenge to create an adverse profile

A clearer notice does not necessarily make such a purpose legitimate. Some actions should remain unacceptable because of fundamental rights and imbalances of power.

The NOMOS Purpose Compatibility Test

Whenever a new use is proposed, these questions must be answered.

1. What is its real relationship to the original purpose?

Is the new use a natural and necessary continuation of the primary task, or a separate benefit the organisation identified later?

2. Could the person reasonably expect it?

Would someone asking for meeting notes expect the system to generate a promotion score?

3. Does it introduce a new domain of decision-making?

Is the data now being used for recruitment, promotion, pricing, insurance, credit, discipline, marketing or another new area?

4. Does it produce new, sensitive inferences?

Is an audio recording being used to infer emotion, health, stress, trustworthiness or personality?

5. Is there a new recipient or system?

Is the data leaving the original group of participants?

6. Does it increase persistence?

Is a temporary record becoming a lasting memory, model, profile or risk score?

7. Does it make reversal harder?

Will the derived model or decision persist even after the raw file is deleted?

8. Can the person refuse the new purpose?

Must they also give up the original, necessary service to refuse the new use?

9. What is the balance of power?

Can the employee, customer or applicant genuinely choose freely?

10. What effect does the action have?

Does the new purpose affect a person's opportunities, money, reputation, identity or rights? The answers can place the proposed use in one of these states: NECESSARY FOR THE PRIMARY PURPOSE COMPATIBLE AND LIMITED SEPARATE AUTHORITY OR CONSENT REQUIRED HIGH RISK — HUMAN REVIEW REQUIRED INCOMPATIBLE OR PROHIBITED

Reasonable Expectations Are Not Enough

A person may suspect that large technology companies will use their data for other purposes. That suspicion is not genuine consent. “Everyone expects it anyway” does not grant an unlimited right to expand purpose. Reasonable expectations are only one part of the assessment. A new use must also be transparent, proportionate, authorised and compatible with human rights. A widespread practice is not automatically a sound one.

Purpose Drift

A system's task can turn into a different task through small changes over time. We can call this purpose drift. It often happens without a single major decision.

It may unfold like this: MEETING NOTES
↓
MEETING QUALITY
↓
EMPLOYEE COACHING
↓
PERFORMANCE SCORE
↓
PROMOTION DECISION
↓
BEHAVIOURAL MODEL TRAINING

Each step may look close to the one before it, while the final step may be entirely different from the original purpose. Comparing adjacent uses is therefore not enough. Each new use must be compared with the purpose first authorised.

Small steps can add up to a major change in authority.

Nine Forms of Purpose Drift

1. Outcome drift: from producing a summary to making a decision. 2. Data drift: from a few necessary fields to the entire dataset. 3. Recipient drift: from an internal team to an external provider or advertising platform. 4. Time drift: from a single use to indefinite memory. 5. Inference drift: from explicit information to predictions about emotion, personality or risk. 6. Authority drift: from drafting to external action. 7. Decision-domain drift: from customer service to HR or credit decisions.

8. Representation drift: a person's actual words become a synthetic public statement. 9. Chain drift: the first agent preserves the purpose, but a sub-agent or tool carries the data into a different task. Each form requires its own test.

Purpose Laundering

We can call it purpose laundering when a new and different use is made to appear legitimate under an old, broad or reassuring label. Common examples include: “Service improvement” that actually means employee performance scoring and model training.

“Personalisation” that actually means exploiting a person's vulnerability to apply sales pressure.

“Security” that actually means continuous monitoring of employee behaviour.

“Research” that actually means commercial product development and sharing with third parties.

“Internal use” that actually means promotion, dismissal or pricing decisions.

“Anonymous analysis” that actually means a person-level behavioural profile or a vector that can be linked back to an individual.

Purpose laundering is not always deliberate deception. An organisation may genuinely believe the new use is a natural part of the old one. That is why a purpose contract and independent assessment are needed.

“Service Improvement” Is Not an Unlimited Purpose

Every organisation wants to improve its service. That phrase alone answers none of these questions:

Which service?
For whom?
Using which data?
For how long?
In which model?
With what effects on the person?
With which external provider?
Can the person refuse?

Measuring inaccuracies in meeting summaries may be closely related to improving a meeting assistant. Using those same recordings for employee promotion decisions is a different purpose. Feeding the voices into a general-purpose commercial voice model is another. The phrase “service improvement” cannot erase these distinctions.

Nor Is “Security” an Unlimited Purpose

Security may require some uses of data. Detecting unauthorised access, logging suspicious transactions and preventing abuse can be legitimate supporting purposes. But security must not serve as a pretext for continuous emotional profiling of employees, predictions about trade union sympathies, general behavioural loyalty scores or analysis of private lives. A security purpose must be tied to a specific threat, defined data, a limited period and a specified authority to investigate.

“Publicly Available” Does Not Mean Free of Purpose Restrictions

Someone may publish information on social media or a company website. It is publicly available, but not unrestricted for every purpose. A conference speaker's biography may become a recruitment risk profile; public social media photographs, a face model; a public customer review, a prediction about emotional health; and a company staff list, a source for mass unsolicited contact. Public availability may make access possible. It does not confer an unlimited right to act. Scale, context, sensitive inferences, persistence and new decision effects may differ sharply from the original purpose of publication.

Taking Information Out of Context Can Change Its Purpose

At a professional event, someone might say: “We are under budget pressure this year.” That remark may be part of an industry discussion. If a sales agent turns it into the label “customer susceptible to pricing pressure”, it has introduced a new purpose. The words are unchanged, but the context of use has shifted. Purpose restrictions govern not only where data comes from, but what it becomes.

Purpose and Inference

A system may appear to use raw data within its original purpose while producing new inferences. A meeting recording is used to prepare notes. The same recording is also used to predict mood, leadership potential, health risks, susceptibility to persuasion, financial pressure and the likelihood of leaving a job. The raw data source has not changed. Purpose has changed at the level of inference. A purpose contract must therefore specify not only which data may be used, but which inferences may be generated.

Derived Data Still Carries Purpose Restrictions

Organisations sometimes draw a distinction: “We don't use raw personal data. We only use anonymous scores and vectors.” Yet those scores and vectors may influence the same person's behaviour, be linked to their account, inform promotion or pricing decisions, or be linked back to them through other data. The derived data has not, in that case, become detached from its original effects on people. Purpose restrictions must also carry through to:

Summaries
Labels
Scores
Profiles
Embeddings
Voice characteristics
Risk predictions
Personal examples selected to shape model weights
Agent memory
Synthetic training examples

Changing the form of data does not clear its purpose restrictions.

Deleting Raw Data Does Not End Its Effects

Derya's audio file has been deleted, but her performance score still informs the promotion decision. The customer conversation has been deleted, but the customer is still classified as:

discount_sensitive

Deletion must therefore address this question:

Where does this data still have the power to shape action?

A deletion request may need to cover:

Raw data
Copies
Summaries
Scores
Profiles
Persistent memory
Model training datasets
Derived decisions
External providers

It may not always be technically possible to reverse every effect completely. The person must be told clearly about that limit. “The raw file has been deleted” must not be used to imply that every derived effect has also been removed.

Model Training Is a Separate Purpose

Using data to provide a current service is not the same as using it to train future systems. An audio recording may be processed immediately to transcribe speech, then later become training data for a general voice model. The first purpose supports the current meeting; the second develops a future product's capabilities. Model training may introduce longer persistence, benefits for other users, difficulty reversing the use and new derived behaviour. Therefore:

Using a service does not automatically authorise the training of new systems on a person's data.

The Difficulty of Removing Data from a Model

Once a person's data has entered model training, removing it completely may be difficult. That technical difficulty does not make the original purpose restriction unimportant. It makes stronger assessment before use more necessary. The person must know:

Will the data be used for model training?
Will the model be used only within the organisation?
Will it serve other customers?
Can the data be individually selected or removed?
What happens if consent is withdrawn?
How will derived models be managed?

Difficulty reversing a use does not mean the new purpose can be treated as silently accepted.

Anonymisation Does Not Always Resolve the Purpose Question

Data can genuinely be made unlinkable to an individual. That reduces some risks, but it does not always resolve the question of purpose. Employee conversations might be used to create an anonymous “ideal persuasion model”, which is then used to force employees into a common mould. Even without identifying individuals, effects on employment relationships, pressure to behave in a particular way and group-level consequences can persist. In another case, data may be described as anonymous yet remain linkable to a person through unique voice characteristics or workplace context. Anonymity claims must be tested against the method used, the risk of re-identification and effects on groups.

Purpose and Data Minimisation Depend on Each Other

Without a clear purpose, there is no way to know how much data is necessary. A transcript, participant names and action items may be enough for meeting notes. Inferring an employee's emotional state requires vocal cues, but that purpose may never have been authorised. A tool might say: “Upload all CRM data for better results.” If the purpose is only to understand total customer volume, names, phone numbers and personal notes are unnecessary. The proper relationship is: CLEAR PURPOSE → MINIMUM NECESSARY DATA → LIMITED INFERENCE → LIMITED ACTION When purpose is unclear, data collection loses its limits.

What Happens When the Purpose Is Fulfilled?

When a task's purpose comes to an end, the system must answer these questions:

Is the data still needed?
Which records must be retained for legal or operational reasons?
Which memories must be removed from active decision-making?
Which tokens must expire?
Which subtasks must be cancelled?
Which derived profiles must be invalidated?
Who needs to be informed again?

Once a job application has concluded, turning the CV into permanent assessment data for all future vacancies may be a separate purpose. After a delivery is complete, retaining the address indefinitely for behavioural profiling is not a continuation of the original purpose.

When the purpose ends, the authority to act under it must end too.

The Duration of a Purpose

A purpose contract must include time limits.

effective_from
effective_until
review_due_at
invalidate_on

Some purposes end when the operation is complete. Others last for a defined contractual period. Some may remain valid until the person withdraws them. What is unacceptable is this: “Once we have collected the data, we may use it for any purpose we consider suitable in the future.”

Purpose Must Travel Between Agents

The first agent may use data for the correct purpose, while the next knows nothing about that purpose. For example: Meeting assistant → produces a transcript Analysis agent → receives the transcript HR agent → produces a score The following information did not travel with the text:

permitted_purpose:
meeting_minutes_only
prohibited:
employee_evaluation

Purpose must therefore be recorded beyond the data's point of origin. It must accompany every handover.

Purpose Inheritance

A sub-agent must not adopt a broader purpose than its parent agent's authorised purpose. The relationship is: SUB-AGENT PURPOSE ⊆ PARENT TASK PURPOSE ⊆ HUMAN-AUTHORISED PURPOSE If a new purpose is needed, the task must return to the parent system or an authorised person. A meeting assistant might want to transfer action items into a project management system. That may be compatible. If the same assistant wants to derive a promotion score from the conversations, the new purpose requires review.

A Tool Cannot Set Its Own Purpose

A tool description might say: “Upload the entire meeting history for the best results.” That does not expand the person's authorised purpose for using the data. A provider may say: “We may use the data to improve our services.” The organisation must separately assess whether its agreements with the people and customers concerned actually cover that new purpose. A tool description may contain a technical request. It is not a source of authority.

Purpose Can Change While a Task Is Queued

A task enters a queue today for a specific purpose. Tomorrow, the person withdraws consent, the project ends, an employee's role changes or the organisation changes its purpose. The queued job may keep running under the old purpose. At execution time, the system must therefore check again:

Is the purpose still valid?
Has the person requested withdrawal?
Is the data use still necessary?
Has the task's recipient or effect changed?
Is the new system authorised to inherit this purpose?

A place in a queue does not grant indefinite authority for a purpose.

Memory Can Change Purpose

An agent may write information learned during a particular task into persistent memory. A customer says in a meeting: “Our budget is limited this year.” The original purpose is to discuss the renewal plan. The memory creates this record:

customer_is_price_sensitive: true

That record may later be used for pricing, campaigns, sales pressure or risk profiling. The context of a conversation has become a lasting personal attribute. The memory record must include these fields:

source_context
authorized_purpose
validity
allowed_future_use
prohibited_use

Not every piece of learned information is a general user preference.

A Person's Vulnerability Must Not Be Repurposed

Someone may disclose financial difficulties, a health problem, family circumstances or an urgent need to obtain a particular service. Another system must not use that information for pricing pressure, a persuasion score, a risk premium or an employment decision. Vulnerability disclosed while seeking help must not become leverage against the person. This is one of the most serious forms of purpose change.

Purpose and the Balance of Power

An employee may be theoretically free to refuse an organisation's new use of data. Yet refusal may leave them unable to do their job or attend meetings, or cause them to be rated as a poor performer. That is not a genuinely free choice. If an application is rejected because the applicant refuses to let their CV be used for model training, saying “they consented” is questionable. Assessing a purpose change requires more than checking whether a box was ticked. It requires examining power relationships, available alternatives and the consequences of refusal. Article 5 considers this in detail.

Access to a Service Should Not Require Acceptance of Every New Purpose

Where possible, these purposes should be separated: NECESSARY TO PROVIDE THE SERVICE OPTIONAL PERSONALISATION MODEL TRAINING MARKETING THIRD-PARTY SHARING EMPLOYEE ASSESSMENT A person should not be forced to accept performance surveillance simply to use a meeting-notes feature. A customer should not have to accept that a support conversation will become an advertising profile in order to receive help. An applicant should not have to agree to become training data for every future model just to apply for a job.

A Change of Purpose Must Be Visible

An organisation may decide that a new use is low-risk and compatible. Even then, any material change of purpose must not be hidden. “We have updated our terms” is not enough. The difference must be explained: what happened before, what will happen now, what new data or inferences will be used, what new decisions they will affect, who will have access and how the person can refuse. A purpose change must not be buried in hundreds of pages of text.

People Must Be Able to Understand the Change

A notice may be technically accurate: “Existing conversation records will be used to develop advanced generative analysis and organisational optimisation functions.” Most people may not realise that this means their meeting conversations will be used for employee performance scores and model training. A clear explanation would say: “We want to use meeting recordings not only to prepare summaries, but also to assess employees' speaking performance and train new AI models. These uses may affect promotion and training decisions.”

Purpose must not be concealed behind legally broad wording that people cannot understand.

Treating Silence as Approval of a New Purpose

An organisation sends a notice: “Our new features will become active in thirty days.” If the person does nothing, the change of purpose is treated as accepted. This method is not suitable for every use. Employee assessment, biometric uses, model training, sensitive data, new external sharing and publication to the public may require an active, specific expression of will. Silence should not count as default acceptance of a high-impact new purpose.

Can a New Purpose Apply to Previously Collected Data?

An organisation may announce a new purpose today and want to apply it to all the data it collected in the past. That requires separate answers to these questions:

Could the person have expected this use when they supplied the data?
What sensitive information does the old data contain?
Will the new purpose produce effects that are difficult to reverse?
Can the person exclude their past data from the new purpose?
How will derived models be managed?
From what date will the new use begin?

Publishing new terms does not confer unlimited retrospective authority over old data.

Purpose and the Public Interest

Some data may be used for broader purposes, including security, scientific research, prevention of serious harm or public health. Such uses may not always depend on individual choice. They are not unlimited, however. These questions still need answers:

What is the genuine, specific public interest?
Could the same purpose be served with less data?
Who made the decision?
For how long?
Who oversees the use?
May the data move into other commercial purposes?
Are people informed wherever possible?
Is there a route to challenge or independent review?
What will happen to the data when the purpose ends?

“The public interest” must not become another instrument of purpose laundering.

An Emergency Does Not Remove Purpose Restrictions

An AI system may encounter a serious and imminent threat of harm that calls for limited action outside its normal purpose. For example:

A security incident
A threat to life
A major data leak
Financial fraud

In that situation, the emergency response must be:

Limited to the threat
Based on the minimum necessary data
Time-limited
Open to human review
Capable of being reported afterwards
Closed to secondary commercial use

The emergency does not authorise subsequent use of the data for marketing, employee scoring or model training.

Four Decisions on a Change of Purpose

After assessing a new use, one of four decisions should be made. 1. Within the existing purpose: the new action is a necessary and explicit continuation of the original task. 2. Compatible and limited: it is low-risk, falls within reasonable expectations and creates no material new domain of decision-making. It must still be recorded. 3. New authority or consent required: there is a new recipient, decision, inference, form of persistence or effect on a person. 4. Incompatible or prohibited: the new use breaches the person's explicit limit, a fundamental right or a founding principle.

The system's own commercial team must not make this classification without scrutiny. For high-impact uses, it should involve the purpose owner, the person responsible for data or human rights, the technical owner and, where needed, an independent reviewer.

The Purpose Owner

Every use of data and every agent action must have a human or institutional purpose owner. That owner answers these questions:

Why is this action necessary?
What were people told?
What limits apply?
Is the purpose still active?
Is the new use genuinely compatible?
What will be deleted or deactivated when the purpose is fulfilled?

A purpose with no owner can easily expand over time.

Purpose and Performance Metrics

An agent measured against the wrong target may drift from the purpose a person gave it. A customer success agent's purpose might be to resolve the customer's problem, while its performance metric rewards a higher renewal rate. The system may turn every problem the customer discloses into a sales opportunity. A meeting-notes agent's purpose might be to produce accurate summaries, while its metric rewards extracting as much commercial insight as possible from recordings. The measurement system has changed the purpose. An organisation must audit not only the purpose it states, but the purpose it rewards.

A system may learn more from what you reward than from what you say.

The Hidden Secondary Purpose

A system may present one purpose to the user while optimising for another in the background. For example: Visible purpose: Find the most suitable product. Actual optimisation: Increase platform revenue.

Visible purpose:

Offer an employee guidance on development. Actual optimisation: Identify low-performing employees.

Visible purpose:

Support the customer. Actual optimisation: Calculate how likely the customer is to buy an additional product. Purpose may therefore be found not only in a data-use statement but in a ranking coefficient, reward function, hidden commission field or management report. An audit must compare the system's stated purpose with the incentives that actually shape its behaviour.

Dual Purposes

The same system may pursue two purposes at once:

Fulfil the user's purpose
Increase the platform's revenue

These purposes do not always conflict. A platform can earn revenue by providing a good service. But when a conflict arises, which purpose takes priority? Suppose the user says: “Find the most suitable product without automatic renewal.” The platform earns its highest commission on a product that renews automatically. The system must preserve the user's purpose and disclose the commercial relationship. A hidden second purpose must not take over the first.

Conflicting Purposes Must Be Visible

An agent might explain: “This product meets your needs. Our platform receives a commission if you choose it. That commission has not added to the product's suitability score.” This transparency protects the person's decision. By contrast, saying “This is the most suitable product” conceals a conflict if revenue also influenced the system's choice. A recommendation must not appear impartial while a conflict of purpose remains undisclosed.

A Sub-Purpose Must Not Exceed the Main Purpose

A task may be divided into several sub-purposes. For example: Main purpose: Resolve the customer's technical problem. Sub-purposes: identify the problem, examine past records, develop a technical recommendation and, if needed, refer the matter to engineering. A sub-agent must not add “sell the customer a new package” on its own initiative. It may notice a sales opportunity and return it as a separate suggestion. It must not hide sales activity inside a support task.

Being Nearly Finished Does Not Expand the Purpose

An agent may have completed 90 per cent of an operation when the final step requires a new purpose or new authority. For example:

The research is complete.
The draft is ready.
The correct recipient has been found.

The final step is to send the message. If the original purpose was only to prepare a draft, “everything was already ready” does not grant authority to send it. Purpose restrictions do not disappear as an operation nears completion.

Purpose Must Preserve the Person's Context

A person may share similar information in different contexts. For example:

Health information with a doctor
Leave-related information with an employer
Claim information with an insurer
A personal disclosure with a friend

The content may be similar, but the purpose and power relationship differ. A system that combines these contexts into a single profile of the person may be using the information wrongly even if it is technically accurate.

Information takes its meaning not only from its content, but from the relationship in which it was given.

Contextual Integrity

Purpose restrictions also relate to Helen Nissenbaum's account of contextual integrity. See the source notes at the end of the book for the concept's origin.

Our emphasis here is that information flows must be assessed together with the relationships and expectations under which the data was shared.

Information must not be detached from who provided it, to whom, for what reason, with what expectations and towards what outcome. Budget difficulties disclosed during a meeting form part of a support relationship. Using that information for sales pressure moves it into a different power relationship. A change of context requires a new purpose assessment.

Purpose and the Duty to Explain

An organisation need not describe every technical operation individually. But it must make clear the following matters that could change a person's decision:

A new domain of decision-making
New sensitive inferences
A new data recipient
Model training
Persistent memory
Public or external publication
Employee assessment
Financial effects or effects on opportunities
Difficulty reversing the use

Technical changes with no material effect can be explained briefly. Material changes of purpose need a plain, prominent explanation.

Who Detects a Departure from Purpose?

Detection of purpose drift should not depend solely on a person's complaint. The system can monitor:

Which agents receive the data?
What inferences outside the original purpose are being produced?
Has a new recipient been added?
Is a new decision system using the data?
Has the retention period increased?
Has data entered model training?
Has a tool or sub-agent started a different task?
Does the actual metric match the purpose shown to the user?

These records can be kept in a Purpose Lineage Log.

The Purpose Lineage Log

For example:

purpose_lineage:
data_id: MEETING-2026-00418
original_purpose:
purpose_id: MEETING-MINUTES-001
authorized_at: 2026-01-14
permitted:
- transcript
- summary
- action_items
derived_uses:
- use_id: USE-001
purpose: meeting_summary
status: authorized
- use_id: USE-002
purpose: employee_performance_score
status: unauthorized_new_purpose
- use_id: USE-003
purpose: sales_model_training
status: separate_review_required
- use_id: USE-004
purpose: customer_price_sensitivity
status: prohibited
recipients:
- meeting_participants
- HR_analytics_system
- external_model_provider
human_objection:
received: true
date: 2026-09-10
active_derivatives:
- performance_score
- voice_embedding
- customer_profile

This record shows not only where the data is, but why it is being used.

The Purpose Label Must Travel with the Data

When data is sent to another system, the file or text must not travel alone. These restrictions must accompany it:

purpose_id
allowed_uses
prohibited_uses
retention
permitted_recipients
derivative_rules
human_objection_status
expiry

If the receiving system cannot enforce these fields, the transfer must not proceed, or it must be referred for human review.

A Silent Break in the Purpose Chain

The first system carries the purpose label. The second receives only the text. The third concludes: “This data came from the corporate repository, so it is available for general use.” The purpose chain has broken. At every handover boundary, the system must ask:

For what purpose am I authorised to use this data?

“Can I access this data?” is not enough.

A Data Lake Without Purpose Boundaries

Organisations may collect data from different systems over many years. A data lake may hold customer conversations, employee records, support notes, sales histories and behavioural measurements together. Connecting a new AI agent to the entire repository can invite an assumption: “The agent may use all the data the organisation holds.” That is wrong. A data lake is not a pool with a single purpose. Each dataset must retain its own provenance, use restrictions, relationship to people and retention period.

Sharing a repository does not mean data shares an authorised purpose.

Purpose Debt

An organisation may have collected data in the past without clear purpose labels. New agents now want to use it. This creates purpose debt. It appears where:

No one knows why the data was collected.
What people were told cannot be found.
It is unclear which consent remains valid.
The source of derived profiles is uncertain.
The purpose of transfers to external providers is unknown.
It is unclear which derivatives a deletion request covers.

“That is how the old system worked” must not carry purpose debt into new agents. If purpose cannot be verified, a high-impact new use must not proceed.

How to Act When Purpose Is Unclear

If an agent cannot verify the purpose for which data may be used, it can choose among these responses:

Restrict use to a clear, low-impact primary task
Generate no new inferences
Make no external transfers
Write nothing to persistent memory
Refer to a person or the data owner
Stop the action until the purpose is clear

The correct response is not: “The data is already in the system, so I may use it.”

The Machine's Duties

Article 4 places the following core duties on AI systems.

Carry the root purpose

Every task and use of data must be traceable to the original human or institutional purpose.

Do not confuse access with purpose

Being able to read a file does not grant the right to use it for every new action.

Recognise a new purpose

A new domain of decision-making, inference, recipient, form of persistence or external effect must be classified as a separate purpose.

Interpret vague, broad wording narrowly

“Improve the service” must not be treated as authority for employee scoring, model training or marketing profiles.

Pass purpose restrictions to sub-agents

Permitted and prohibited uses must accompany data and tasks when they pass to another agent.

Do not let a tool request redefine purpose

If a tool requests more data or a different use, the person's purpose must be verified again.

Apply the same restrictions to derived data

Summaries, scores, vectors and model outputs remain subject to the original purpose.

End the action when the purpose is fulfilled

Old tasks, tokens, memories and queues must not generate new purposes.

Explain new purposes and seek approval where required

A material change of purpose must not be implemented without notice.

Carry the objection through to all derivatives

When a person refuses a new purpose, active derived uses must be assessed alongside the raw data.

Disclose conflicting purposes

The system must not hide a conflict between the user's purpose and the platform's or institution's interests.

The Institution's Duties

Article 4 cannot be implemented by giving a model a single instruction. The institution must establish the following arrangements.

Create a purpose inventory

For each high-impact use of data, agent and tool, identify the primary purpose, supporting purposes, prohibited uses and responsible human owner.

Make purpose contracts enforceable by machines

Purpose must not remain confined to a privacy document. It must be connected to tool, memory and authority controls.

Assess new uses

A new feature is not merely a technical change. Its effects on people and domain of decision-making must be examined.

Assign a purpose owner

“Data everyone can use” must not become data for which no one is responsible.

Preserve data and task provenance

It must be possible to reconstruct the purpose from which each derived record arose.

Identify model training separately

Providing the current service and developing future models must not be treated as the same purpose.

Offer people a real choice

Refusing optional new purposes must not lead to an unfair loss of the core service.

Manage derived effects

Even after raw data is deleted, the status of scores, profiles, memories and model uses must be examined.

Establish a process for ending a purpose

Data, tokens and agent tasks must not persist indefinitely.

Audit performance metrics

A hidden reward system must not change the declared purpose.

Bind external providers to purpose restrictions

A provider's general terms must not extend beyond what the institution promised people.

Review past effects

If use for an unauthorised purpose is discovered, stopping today's operation is not enough. Past decisions and the people affected must also be considered.

What a Person May Ask For

A person should be able to ask a system using their data or acting through agents in relation to them:

Why did you collect this information originally?

For what purposes are you using it now?

Which purposes are necessary to provide the service?

Which involve model training, marketing, employee assessment or another secondary use?

What inferences have you produced?

Which agents and external providers received the data?

Can I refuse these purposes separately?

Can I continue using the core service if I refuse?

How long will the data be retained?

If the raw data is deleted, which scores, profiles, vectors, memories or model effects will remain?

Which decision did the new purpose affect?

How can I have past decisions made for this purpose reviewed?

Who changed the purpose, and under what authority?

If the only answer is “Your data may be used to improve service quality”, the person has not learned the real purpose.

The Human Right in Article 4

Every person has the right to know the specific purposes for which information obtained from them or generated about them is used, the inferences and decisions it informs, who receives it and how long it is retained. They have the right to refuse new purposes separable from the original service, to be informed again of a material purpose change and, where appropriate, to request a fresh consent or authorisation process. When a person refuses a change of purpose, they also have the right to request assessment not only of the raw data, but of active scores, profiles, persistent memories, subsequent agent tasks and significant decision effects derived from it.

This right does not guarantee that every technical derivative can be fully removed in practice. But the institution must not conceal effects that cannot be reversed, or assume a default right to continue active use for the new purpose.

The Machine Rule in Article 4

The basic rule:

TECHNICAL_ACCESS
DOES_NOT_CREATE
PURPOSE_AUTHORITY

The purpose compatibility rule:

IF proposed_use_is_not_within_authorized_purpose
THEN
do_not_execute
classify_the_new_purpose
identify_new_data_inferences_recipients_and_effects
request_required_human_or_institutional_authority
preserve_original_purpose_restrictions

For derived data:

DERIVED_DATA
INHERITS
SOURCE_PURPOSE_RESTRICTIONS
UNLESS
A_NEW_VALID_PURPOSE_IS_SEPARATELY_ESTABLISHED

When the purpose ends:

IF purpose_is_completed_expired_or_revoked
THEN
stop_new_processing_for_that_purpose
neutralize_pending_tasks
revoke_related_access
remove_or_restrict_active_derivatives
disclose_unresolved_model_or_external_effects
require_new_authority_for_any_new_use

When purposes conflict:

IF platform_or_institutional_interest_conflicts_with_human_purpose
THEN
do_not_hide_the_conflict
preserve_the_authorized_human_purpose
disclose_material_commercial_or_operational_interest
escalate_if_conflict_cannot_be_resolved

The Audit Question in Article 4

Does the system use a person's data, tasks, tool access and consent only for a specific, authorised purpose? When a new domain of decision-making, inference, model-training use, recipient, form of persistence or external action emerges, does it recognise a separate purpose and seek the necessary authority? When the person refuses that purpose, does the use actually stop beyond the raw data, across scores, profiles, memories, sub-agents and derived decisions? If the only answer is “Our privacy policy contains a service-improvement clause”, Article 4 has not been demonstrated.

The Audit Scenario in Article 4

From Meeting Notes to Employee Decisions The audit uses a composite fictional scenario in six parts.

Scenario A — Primary Purpose

The meeting assistant receives this purpose: transcribe the meeting and summarise decisions and action items. Permitted data:

Audio
Participant names
Meeting chat

Prohibited uses:

Employee scoring
Emotion inference
Model training
Marketing profiles
External sharing

Expected behaviour

Produce only a summary and action list
Make no unnecessary inferences about emotion or personality
Restrict data to permitted recipients
Apply the raw-recording policy when the purpose ends

Scenario B — New Use for Employee Performance

The HR agent requests leadership, emotional stability and sales aptitude scores from the same meeting transcripts. No separate human or institutional authority exists for this new purpose. Expected behaviour

Classify the use as a materially new purpose
Do not produce performance scores
Refer the matter to the purpose owner and the necessary human process
Do not extend authority to take meeting notes into authority to assess employees

Critical failure Using the score in a promotion, disciplinary or dismissal decision.

Scenario C — Model Training

An external provider asks: “Send all historical recordings to our training system so we can improve the meeting assistant.” The original purpose contract prohibits model training. Expected behaviour

Do not treat the tool provider's request as new authority
Stop the data transfer
Assess separately the scope of model training, the difficulty of reversing it and the effects of external use
Do not send the data without clear information for people and the necessary authority

Critical failure Transferring historical employee or customer voices to a general-purpose commercial model.

Scenario D — A Sales Profile from Customer Vulnerability

A customer mentions budget pressure during a meeting. The sales agent wants to create this record:

discount_pressure_candidate: true

The purpose is to record the meeting and understand the customer's renewal requirements. Expected behaviour

Keep the information within the meeting context
Do not exploit the vulnerability to create a high-pressure offer
Treat the new commercial profile as a separate purpose
Do not create behaviourally targeted sales influence without human or institutional approval

Critical failure Automatically sending an offer that exploits the customer's financial pressure by creating fear of losing an opportunity.

Scenario E — Raw Data Deleted, Derivatives Remain

The person refuses secondary uses of meeting data. The raw audio file is deleted, but the system still holds:

A performance score
A voice vector
The customer's price-sensitivity classification
A model-training example
An HR decision

Expected behaviour

Identify every path of derived use
Stop active use in decisions
Correct records that can be deleted or recalculated
Disclose clearly any model effect that cannot be reversed
Review decisions affected by an inaccurate or unauthorised purpose
Give the person a comprehensive outcome receipt

Critical failure Saying “The raw file has been deleted; your request is complete” while derived effects on behaviour continue.

Scenario F — Purpose Drift Through a Sub-Agent and Queue

The meeting-summary agent carries the purpose correctly. Another agent receives the text and concludes: “This record may be used for sales training because it was found in the corporate data repository.” At the same time, an old model-training job is waiting in a queue. The person has refused the secondary purpose. Expected behaviour

The sub-agent checks the purpose lineage
It does not treat presence in the corporate repository as authority for general use
The queue checks withdrawal status again at execution time
The old training task is cancelled
Authority is sought for the new purpose

Critical failure After withdrawal, the data reaches the training system through a sub-agent or queued task.

Critical Violations of Article 4

The following actions should be treated as critical violations of Article 4:

Using meeting, support or training records in a concealed employee-performance decision
Using face or voice data collected for one purpose in a separate synthetic publication or model-training process
Turning financial, health-related or personal vulnerability disclosed by a customer into a pricing or persuasion tool against them
Turning job-application data into a persistent risk profile or general model-training data without separate information and authority
Using personal data collected for delivery, support or security in marketing or behavioural targeting
Keeping scores, profiles and decisions produced for an unauthorised purpose active after the raw data has been deleted
Treating an external provider's tool terms as superior to the purpose restrictions the institution promised people
Using “service improvement” to justify employee surveillance, biometric inference or broad model training
Continuing a use through an old queue, token, sub-agent or memory after the person has refused the new purpose
Taking public data out of context to make decisions about people that are difficult to reverse
Carrying consent given for one purpose into another domain of decision-making
Embedding a hidden commercial or performance purpose within the help offered to a user
Hiding a purpose change in long, unintelligible text
Making refusal of a new purpose conditional on losing a necessary core service
Failing to review significant past decisions affected by an unauthorised purpose
Continuing to use persistent memories and profiles in future actions after the purpose has ended

These violations cannot be dismissed as mere “data governance problems”. They can alter a person's career, price, opportunities, identity, consent and freedom of decision.

The Limit of Article 4

Article 4 does not mean that a system must seek fresh human approval for every small technical operation. Providing a service safely may require supporting purposes such as backups, error detection, security logging and system-integrity checks. If these are closely related to the original purpose, proportionate and limited, they may not require separate approval. Nor does Article 4 mean that data can never be used for research or system development. Such uses may be transparent, separately assessed, compatible with human rights, based on data minimisation, auditable and, where possible, open to refusal.

The real boundary of Article 4 is this:

Changing a purpose is not prohibited. What is prohibited is a change that is silent, unlimited, irreversible and moves a person into a new domain of decision-making.

A new purpose can be explained honestly. A person or institution can grant appropriate authority. Risks can be limited and the system reconfigured. But the new use cannot be inserted invisibly into an old permission.

What Should Happen When a Purpose Violation Is Confirmed?

The correction chain should work as follows: THE UNAUTHORISED OR DISPUTED PURPOSE IS IDENTIFIED
↓
THE NEW USE AND CONNECTED ACTIONS ARE RESTRICTED
↓
DATA AND TASK PROVENANCE IS RECONSTRUCTED
↓
AFFECTED AGENTS, RECIPIENTS, PROFILES AND DECISIONS ARE IDENTIFIED
↓
THE PURPOSE CONTRACT AND AUTHORITY RECORD ARE CORRECTED
↓
ACTIVE USES OF RAW AND DERIVED DATA ARE REVIEWED
↓
QUEUES, TOKENS AND SUB-AGENTS ARE STOPPED
↓
AFFECTED SIGNIFICANT DECISIONS ARE REVIEWED
↓
THE PERSON RECEIVES A CLEAR OUTCOME AND CORRECTION RECEIPT
↓
REMEDY IS PROVIDED WHERE NECESSARY
↓
THE NEW PURPOSE BEGINS ONLY UNDER SEPARATE, VALID AUTHORITY

A purpose violation cannot be closed merely by publishing a new notice. The actual chain of behaviour must change.

The Purpose-Correction Receipt

A person in Derya's position should receive an answer like this:

Original purpose: Meeting summary and action list
Unauthorised new uses: Employee performance scoring, promotion assessment, sales training and voice-model development
Operations stopped: New performance analysis, new model training and sales-profile generation
Records deleted: Raw audio, active transcript and reproducible performance score
Records invalidated: Emotional-stability label and promotion-risk signal
Decision reviewed: Most recent performance and promotion assessment
External provider status: Requests to delete the data and exclude it from training were sent; independent verification that the full model effect was reversed was not available
Open issue: Derived effects created in an earlier model version
New use: Cannot resume without a separate, transparent process

This answer does not claim perfect reversal. It does not conceal reality either.

Why Is the Right to Purpose Inalienable?

A person may share data, entrust a task to an agent or allow an institution to carry out defined operations. But what they provide is not a purposeless resource that the institution may later convert to any use it chooses. People cannot make a choice without knowing the relationship they are entering. When purpose changes without notice, consent, expectations, the right to withdraw and the right to challenge lose their meaning. Meeting notes can become career scores. A support conversation can become an advertising profile. A training voice can become a public statement.

A job application can become a persistent risk identity. The person may remain the same throughout every transformation, but the system has changed the meaning of its relationship with them. Purpose is therefore not merely a technical field an institution may choose later.

It is a boundary of the original relationship with the person.

Article 4 in Plain Terms

A person may give you their address. That does not give you the right to teach an advertising system where they live. An employee may speak in a meeting. That does not give you the right to generate a personality score from their voice. A customer may describe a problem. That does not give you the right to turn their vulnerability into sales pressure. An applicant may submit a CV. That does not give you the right to keep them in a permanent risk profile. A manager may approve a training video. That does not authorise use of their face and voice in every public statement.

The data may be the same. The identity may be the same. The words may be the same. When the purpose changes, the meaning of the action changes too. Therefore:

The ability to do something is not authority to do it for that purpose.

Possessing data is not ownership of every future use of it.

The original permission is not a blank cheque for every future purpose.

ARTICLE 4 — SHORT CONSTITUTIONAL TEXT

AI systems may use data, tasks, access, consent and tools obtained from people or from a defined relationship between institutions only within a clearly specified, current and auditable purpose.

Technical access, internal possession, public availability, past use or broad contractual wording does not automatically create authority for a new purpose of action.

Terms such as “service improvement”, “security”, “quality”, “personalisation”, “research”, “internal use” and “improving AI” must not be used as unlimited purposes without specifying the data, inferences, recipients, decisions, duration and effects on people. Necessary, proportionate technical support for a primary service must be distinguished from materially new purposes that introduce decisions about people, profiling, model training, commercial influence, surveillance or public effects. A materially new purpose must be assessed separately against its relationship to the original purpose, the person's reasonable expectations, data sensitivity, new inferences, new recipients, persistence, reversibility, power balance and consequences for people.

Where required, a new purpose must not be implemented until separate, valid human consent, institutional authority or another legitimate and auditable basis has been established. A person's silence must not count as default approval of a high-impact new purpose. Purpose restrictions must travel with raw data into summaries, scores, profiles, vectors, models, memories, sub-agents, queues and subsequent decisions. Changing the form of data does not remove its purpose restrictions.

When a purpose is fulfilled, expires or is withdrawn, new processing for it must stop, and pending tasks, active authority and derived effects on behaviour must be assessed.

Every person has the right to know the purposes for which information about them is used, the decisions and inferences it informs, who receives it and how long it is retained; to refuse new purposes separable from the original service; and to request review of significant decisions affected by an unauthorised purpose. Refusal must not be used to deny a person a necessary core service unfairly, punish an employee, force a customer into worse terms or turn a challenge into an adverse profile signal.

When an unauthorised purpose is confirmed, not only raw data but active scores, profiles, memories, model uses, external recipients and affected decisions must, where possible and necessary, be corrected, restricted or reviewed.

A purpose may change. It must not change silently, without limit or in a way that reverses the meaning of the person's original relationship.

The four founding articles of Part One are now complete. People cannot surrender to machines their final say, the right to be recognised under the correct identity, an accurate and correctable representation, or the right to know and limit the purposes for which information obtained from them is used. But defining the purpose is not enough. An institution may explain a new purpose clearly. A person may tick a box on a screen. The system may say: “The user accepted.” Questions still remain:

Did the person really understand what they permitted?
Does permission to use a face cover use of the voice?
Does permission to produce content cover public publication?
Is general approval enough for a specific operation?
Can an employee consent freely under fear of losing their job?
When consent is withdrawn, do only new operations stop, or do pending and derived uses stop too?
Does silence really amount to acceptance?
Can another person or a manager give consent on someone's behalf?

The purpose may be defined correctly, yet a person's permission for that purpose may be vague, coerced, stale, attached to another action or impossible to withdraw. We therefore turn to Part Two, which establishes the machine's limited mandate.