Privacy Act 2020, s 22, principle 10
If information about you has been collected for one purpose it can’t later be used for a different purpose, unless the organisation or person using it believes on reasonable grounds that:
the other purpose is directly related to the purpose for which the information was originally collected, or
you won’t be identified, or
you’ve agreed to the information being used for the other purpose, or
the information is publicly available and it wouldn’t be unfair or unreasonable to use it for the other purpose, or
using it for the other purpose is necessary to enforce the law, or to protect government revenue, or for any court proceedings, or
using it for the other purpose is necessary to prevent or lessen a serious threat to your health or safety, or the health or safety of someone else, or
the Privacy Commissioner has authorised the information being used for another purpose.
In summary, information obtained for one purpose shouldn’t be used for another purpose, unless one of the exceptions applies. For example, if a retail shop runs a competition and customers fill out a form to win a holiday, the shop shouldn’t use the customer’s information for marketing purposes as well as for the competition, unless customers were told this would be done when they filled out the form.