Collection Must only collect personal information that is necessary for one or more of its functions or activities. Must collect personal information only by lawful and fair means and not in an unreasonably intrusive way. If personal information is collected from third parties, must take reasonable steps to ensure the individual is aware of matters listed under third bullet point above. In direct marketing, customer must be given the option not to receive communications both at the time of first contact and at any time afterwards.
Personal information is destroyed or permanently de-identified if no longer needed.
Openness Must have available on request a clearly expressed policy statement outlining personal information handling practices. On request, take reasonable steps to let a person know what personal information it holds, for what purposes, how it collects, holds, uses and discloses that information. Access and Correction Must provide an individual with access to personal information about that individual. May charge a reasonable fee for access. Must take reasonable steps to correct information.