The entity limits the use of personal information to the purposes identified in the entity’s objectives related to privacy
Personal information is used only for the intended purposes for which it was collected and only when implicit or explicit consent has been obtained unless a law or regulation specifically requires otherwise.