A. The purpose for which personal information is collected shall be identified by the organization at or before the time the information is collected.

B. Upon request, an individual shall be informed of the existence, use and disclosure of their personal information and shall be given access to that information.

C. The degree to which personal information must be kept accurate and complete is determined by whether its original purpose has been achieved.

D. Personal information shall be protected by the same security safeguards regardless of the sensitivity of the information.