Sec. 201 Minimization and articulated basis for collection, processing, and maintenance
Articulated basis— A covered entity shall have a reasonable, articulated basis for the collection, processing, disclosure, and maintenance of personal information that takes into account the reasonable business needs of the covered entity and minimum amount of personal information necessary for providing the service, balanced with the intrusion on the privacy of, potential privacy harms to, and reasonable expectations of individuals to whom the personal information relates.
Minimization of collection, processing, disclosure, and maintenance—
Collection— A covered entity may not collect more personal information than is reasonably needed to provide a product or service that an individual has requested.
Processing— A covered entity may not process personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity.
Disclosure— A covered entity may not disclose personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity.
Maintenance— A covered entity may not maintain personal information once such information is no longer needed for the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity.
Ancillary collection, processing, disclosure, and maintenance— Notwithstanding subsection (b), a covered entity may engage in collection, processing, disclosure, or maintenance of personal information beyond limitations under subsection (b) only if such covered entity complies with this subsection.
No notice or consent required— A covered entity may engage in collection, processing, or maintenance of personal information without additional notice or consent if the purpose for such collection, processing, or maintenance is substantially similar to the type of personal information and purpose for which such personal information was originally collected and such ancillary collection, processing, or maintenance will not result in additional or increased privacy harms.
Notice required— A covered entity shall provide notice of ancillary collection, processing, disclosure or maintenance of personal information in the case of one, but not more than one, of the following:
Such ancillary collection, processing, disclosure, or maintenance may result in additional or increased privacy harms (but not increased significant privacy harms), and is substantially similar to the purpose for which such personal information was originally collected.
The purpose for such ancillary collection, processing, disclosure, or maintenance is not substantially similar to the purpose for which such personal information was originally collected, but will not result in additional or increased privacy harms.
Such ancillary collection, processing, disclosure, or maintenance may result in additional or increased privacy harms (but not increased significant privacy harms) and the purpose is not substantially similar to the purpose for which such personal information was originally collected, so long as, the personal information is secured using privacy preserving computing.
Notice and consent required— For scenarios not covered under paragraph (1) or (2), and notwithstanding section 212(b)(2) and (3), a covered entity shall provide notice of and obtain consent for ancillary collection, processing, disclosure or maintenance of personal information.
Substitution— In cases in which personal information can be replaced with artificial personal information, personal information that has been de-identified, or the random personal information of a one or more individuals without substantially reducing the utility of the data or requiring an unreasonable amount of effort, such a replacement shall take place.