once such information is no longer needed for the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity. (c) Ancillary collection, processing, disclosure, and maintenance Notwithstanding subsection (b), a covered entity may engage in collection, processing, disclosure, or maintenance of personal information beyond limitations under subsection (b) only if such covered entity complies with this subsection. (1) No notice or consent required A covered entity may engage in collection, processing, or maintenance of personal information without additional notice or consent if the purpose for such collection, processing, or maintenance is substantially similar to the type of personal information and purpose for which such personal information was originally collected and such ancillary collection, processing, or maintenance will not result in additional or increased privacy harms. (2) Notice required A covered entity shall provide notice of ancillary collection, processing, disclosure or maintenance of personal information in the case of one, but not more than one, of the following: (A) Such ancillary collection, processing, disclosure, or maintenance may result in additional or increased privacy harms (but not increased significant privacy harms), and is substantially similar to the purpose for which such personal information was originally collected. (B) The purpose for such ancillary collection, processing, disclosure, or maintenance is not substantially similar to the purpose for which such personal information was originally collected, but will not result in additional or increased privacy harms. (C) Such ancillary collection, processing, disclosure, or maintenance may result in additional or increased privacy harms (but not increased significant privacy harms) and the purpose is not substantially similar to the purpose for which such personal information was