This is essentially the challenge. This is the challenge under private-sector data protection legislation as well. There have to be certain norms for the collection of personal information and for compliance with those norms.
On February 14th, 2017. See this statement in context.