; (2) until consent is revoked; and (3) one or more additional durations based on reasonable expectations and norms for the maintenance of the category of personal information being maintained. (c) Exception for implied consent Where the long-term maintenance of personal information is, on its face, obvious and a core feature of the product or service at the request of the individual, and the personal information is maintained only to provide such product or service, subsections (a) and (b) shall not apply. 109. Exemptions, exceptions, fees, timelines, and rules of construction for rights under this title (a) Exemptions for personal information for particular purposes (1) In general This title does not apply with respect to personal information that is collected, processed, maintained, or disclosed for any of the following purposes (or a combination of such purposes), where a covered entity has technical safeguards and business processes that limit the collection, processing, maintaining, or disclosure of such personal information to the following purposes: (A) Detecting, responding to, or preventing security incidents or threats. (B) Protecting against malicious, deceptive, fraudulent, or illegal activity. (C) Complying with specific law enforcement requests or court orders. (D) Protecting a legally recognized privilege or other legal right. (E) Protecting public safety. (F) Collection, processing, or maintenance by an employer pursuant to an employer-employee relationship of records about employees or employment status, except— (i) where the information would not be reasonably expected to be collected in the context of an employee’s regular duties