; (C) compliance with legal process or other purposes expressly authorized under specific legal authority; or (D) other purposes— (i) that are specified in a notice to the minor; and (ii) to which the minor has consented under paragraph (7) before the information is used or disclosed for such other purposes. (4) Retention limitation principle The personal information of a minor should not be retained for longer than is necessary to fulfill a transaction or provide a service requested by the minor or such other purposes specified in subparagraphs (A) through (D) of paragraph (3). The operator should implement a reasonable and appropriate data disposal policy based on the nature and sensitivity of such personal information. (5) Security safeguards principle The personal information of a minor should be protected by reasonable and appropriate security safeguards against risks such as loss or unauthorized access, destruction, use, modification, or disclosure. (6) Openness principle (A) In general The operator should maintain a general policy of openness about developments, practices, and policies with respect to the personal information of a minor. The operator should provide each minor using the website, online service, online application, or mobile application of the operator with a clear and prominent means— (i) to identify and contact the operator, by, at a minimum, disclosing, clearly and prominently, the identity of the operator and— (I) in the case of an operator who is an individual, the address of the principal residence of the operator and an email address and telephone number for the operator; or (II) in the case of any other operator, the address of the principal place of business of the operator and an email address and telephone number for the operator; (ii) to determine whether the operator possesses any personal information of the minor, the nature of any such information, and the purposes for which the information was collected and is being retained