This is the company's point of view.
In the act, there are provisions stating that companies should not collect more information than is necessary for them to achieve their purpose, but the determination of what is necessary is made by the organization.