Can a municipal authority use the data on recipients of veteran and disability benefits, which it processes lawfully, for any other purposes, such as sending of congratulatory cards?

According to Article 8, item 2 of the Law on Personal Data Protection, processing is not allowed if it is done for purposes other than those specified, regardless whether it is based on a person's consent or on statutory powers for data processing without consent. The sole exception to this rule is processing of personal data for the purpose of collecting charitable donations. The principle of prior identification of the purpose of data processing, i.e. the principle of processing the data solely for their intended purposes, is a tenet of personal data processing. It means that data can be processed only for purposes explicitly provided for by the law or consented to by the data subject. Data collected for one purpose cannot be used for any other purpose. Although it has become rather customary for the data held by a data controller to be used for purposes different from those originally intended (e.g. sending of New Year, birthday and other cards or advertising specific products etc.), this is not allowed from the aspect of the Law on Personal Data Protection, including specifically Article 8, item 2 quoted above. Any processing of personal data for the purposes of direct marketing requires explicit consent of the data subject, which must be given in accordance with Articles 10 and 15, paragraph 1 of the Law on Personal Data Protection.