We have to remember that when we talk about personal information writ large, it's not just about sensitive information. All the obligations, whether about security safeguards or about retention and disposal, as my colleague said, are applied to all personal information. It's the degree that changes.
With respect to any personal information, there is obviously the appropriate purpose. You can't collect, use or disclose any personal information unless you have an appropriate purpose for doing so, and that's an obligation that applies to all personal information, not just sensitive personal information. You can't use information just because you want to. That's an obligation that applies in all contexts.