[LadyMischief]

Oh and yet MORE responsibility and liability with regards to personal information:
Your responsibilities

* Before or when any personal information is collected, identify why it is needed and how it will be used.
* Document why the information is collected.
* Inform the individual from whom the information is collected why it is needed.
* Identify any new purpose for the information and obtain the individual's consent before using it.

How to fulfil these responsibilities

* Review your personal information holdings to ensure they are all required for a specific purpose.
* Notify the individual, either orally or in writing, of these purposes.
* Record all identified purposes and obtained consents for easy reference in case an individual requests an account of such information.
* Ensure that these purposes are limited to what a reasonable person would expect under the circumstances.