# Surveillance Purpose Migration **Entity class:** Data-governance harm **Domains:** Public-health surveillance / law enforcement / national security ## Definition **Surveillance purpose migration** is the movement of data collected under one authority and purpose, such as contact tracing or infection control, into a different authority and purpose, such as criminal investigation or security analysis. It is the operational form of [[wiki/Function Creep|function creep]] and the update-stage harm of the [[wiki/CVE-CVE Convergence|CVE-CVE]] loop, because relational health data is the exposure graph a threat-network model seeks. ## Documented record Singapore described TraceTogether data as collected for contact tracing and COVID-19 control; in January 2021 the government clarified that police had legal authority to obtain it for criminal investigations, and later legislation narrowed permissible criminal use to specified serious offences. In Germany, the Rhineland-Palatinate data-protection authority opened proceedings after Mainz prosecutors, police, and the local health authority used Luca contact-tracing records in a criminal investigation despite infection-control purpose limits. WHO guidance states that identifiable surveillance data generally should not be shared for unrelated law-enforcement, national-security, or social-benefit purposes without compelling justification and legal process. ## Austin relevance Contact-tracing data collected by [[wiki/Dell Medical School|Dell Medical School]] under [[wiki/Austin Public Health|Austin Public Health]] authority was used for public-health effectiveness research. Whether Austin-origin relational health data has entered any threat-model pipeline is unresolved. ## Relationships - **general pattern:** [[wiki/Function Creep|Function Creep]] and [[wiki/Purpose Limitation|Purpose Limitation]]. - **data source class:** [[wiki/Contact Tracing|Contact Tracing]] and [[wiki/Digital Contact Tracing|Digital Contact Tracing]]. - **downstream cost:** [[wiki/Surveillance Trust Externality|Surveillance Trust Externality]]. - **governance seam:** [[wiki/Operational Activity and the Common Rule|Operational Activity and the Common Rule]]. - **accounting frame:** [[wiki/The Second Error Function|The Second Error Function]]. - **analysis:** [[research/Harms Incurred While Bringing Preventive Systems Online|Harms Incurred While Bringing Preventive Systems Online]]. - **collection:** [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]]. ## Sources / Provenance - [Singapore MDDI — Factsheet on the TraceTogether Programme](https://www.mddi.gov.sg/newsroom/factsheet-tracetogether-programme/) (accessed 2026-09-23). - [Datenschutz Rheinland-Pfalz — proceedings on Luca app contact data use by prosecutors](https://www.datenschutz.rlp.de/service/aktuelles/detail/nach-erhebung-und-nutzung-von-kontaktdaten-aus-der-luca-app-durch-die-staatsanwaltschaft-datenschu) (accessed 2026-09-23). - [WHO — Q&A: Ethics in Public Health Surveillance](https://www.who.int/news-room/questions-and-answers/item/q-a-ethics-in-public-health-surveillance) (accessed 2026-09-23). **As of:** 2026-09-23