; (ii) shall remain in effect until the individual revokes or limits that denial or withdrawal; and (iii) shall not apply to any collection or processing of personal data that occurred before the date on which the withdrawal is made. (c) Permissible purposes A covered entity or service provider may collect or process the personal data of an individual without consent to the extent that such collection or processing is reasonably necessary and limited to the following purposes (except that a covered entity that is a third party with respect to personal data may not collect or process such data without consent for the purposes described in paragraphs (3), (5), and (6)): (1) Provision of service or performance of a contract To— (A) provide a service, perform a contract, or conduct a transaction that the individual has initiated; or (B) take steps in furtherance of the request initiated by the individual prior to providing the service or entering into a contract or transaction. (2) Compliance with laws To comply with a Federal, State, or local law or another applicable legal requirement, including a subpoena, summons, or other properly executed compulsory process, or to exercise or defend a legal claim, as specifically authorized by law. (3) Immediate danger To prevent imminent danger to the personal safety of any individual, including by effectuating a product recall pursuant to Federal or State law. (4) Fraud prevention and protection of security To protect the rights, property, services, or information systems of the covered entity or service provider, or any individual, including to investigate a possible crime or to protect against security threats, abuse, malicious conduct, deception, fraud, theft, unauthorized transactions, or any other unlawful activity. (5) Research In the case of a covered entity only, to conduct research that— (A) is performed for the primary purpose of advancing a broadly recognized public interest