Data privacy refers to the protection of personally identifiable information. The term is typically used in connection with information collected, used, and disseminated by businesses, the government, [Page 840]and other organizations. A reasonable expectation of privacy exists in that the information is shared with an organization for one purpose; that expectation is met as long as the information is not collected, used, or disseminated—intentionally or otherwise—for any other purpose.

The privacy of the personally identifiable information endures as long as the organization holds onto that information. However, how an organization destroys information (i.e., shreds physical records and/or deletes digital copies) is also important.