Why purpose limitation keeps failing
Purpose limitation is the engine of the duty of loyalty, and it has repeatedly eroded. The Privacy Act's "routine use" exception, the GDPR's "compatible purpose" test and similar state provisions leave compatibility vaguely defined and let the institution that benefits from a broad reading decide it. What has been missing is an account of why cross-purpose use is wrongful regardless of the label an institution gives it.
Authorized Informational Context
The answer is that authority is relational. An exercise of informational power is authorized only if it falls within all seven components of the context that gave rise to it:
| Component | What it bounds |
|---|---|
| Purpose | The specific objective. "Law enforcement" is not a purpose; investigating a specific reported burglary is. |
| Authority | The source and scope of legal authority. A subpoena for financial records does not reach medical records in the same database. |
| Roles | The capacity in which each actor acts. Custody does not merge different roles into one domain. |
| Information | The attributes in scope. Authority to verify age is not authority to see a birth date. |
| Operations | What may be done. Authority to read is not authority to copy, combine, infer or transmit. |
| Temporal conditions | When the authority expires. Retention past the context is itself an exercise of power. |
| Disclosure conditions | Who may receive it. Each transmission is a context transition requiring its own justification. |
Context defines the scope of entrusted power. Loyalty determines whose interests govern its exercise. An actor who exercises power outside the originating context acts disloyally unless an independent source of authority establishes a new context.
Context collapse is how the general warrant returns
Every record in an integrated database arrived through a bounded context: a tax return, a license application, a benefits claim. Aggregating them into one queryable system destroys those boundaries, so that an official can query across all of them without independent authority for any. That converts thousands of particular authorizations into a general one. The Otis characteristics describe the symptoms; context collapse is the mechanism.
The concept draws on Helen Nissenbaum's contextual integrity, but asks a prior and more demanding question: not whether a flow fits social norms, but whether the actor has legitimate authority to perform a specific operation on specific information within a specific relationship. It also completes NIST's attribute-based access control and Zero Trust frameworks, which can enforce contextual policies but are indifferent to whether those policies are legitimate. Technology supplies the tools; law supplies the authority they must enforce.