and disclosure of personal information and acknowledge the principle of data minimization, which means that data should only be collected and used for the purposes specified and reasonably necessary to the company’s legitimate legal and business needs.