Personal Information may only be used or disclosed for the purpose for which it was collected unless otherwise consented, or when it is required or permitted by law.