The law requires that sensitive personal data or information (SPDI) cannot be collected unless the information is collected for a lawful purpose connected with a function or activity of the party collecting or using the information and the collection of the SPDI is considered necessary for that purpose. Consent must be obtained from the provider of the SPDI regarding the purpose of usage before collection of the information, and the provider must be made aware through reasonable steps of the following: The fact that the information is being collected; the purpose for which it is collected; the intended recipients; and the name and address of the agency collecting or retaining the information. In addition, the privacy rules specify that the SPDI cannot be retained for longer than is required for the purpose for which the information can lawfully be used or is otherwise required under any other law currently in force.
