Requirement
Personal information is collected consistent with the entity’s objectives related to privacy.
Points of Focus
Limits the Collection of Personal Information [P][C]
Requirement: The collection of personal information is limited to that necessary to support the achievement of the entity’s objectives.
Collects Information by Fair and Lawful Means [P][C]
Requirement: Methods of collecting personal information are reviewed by management before they are implemented to confirm that personal information is obtained (a) fairly, without intimidation or deception, and (b) lawfully, adhering to all relevant rules of law, whether derived from statute or common law, relating to the collection of personal information.
Collects Information From Reliable Sources [P][C]
Requirement: Management confirms that third parties from whom personal information is collected (that is, sources other than the individual) are reliable sources that collect information fairly and lawfully.
Informs Data Subjects When Additional Information Is Acquired [P][C]
Requirement: Data subjects are informed if the entity develops or acquires additional information about them for its use.
Explanation
The organization should collect only the personal information it genuinely needs, and gather it fairly and lawfully — no deception, and only from trustworthy sources. Auditors look for management review of collection methods, vetting of third-party sources, and notice to individuals when additional information about them is acquired.
