; or (3) maintain personal information or contents of communication longer than the covered entity would otherwise maintain such personal information. (h) Regulations The Director shall promulgate regulations to implement this section. II Requirements for Covered Entities, Service Providers, and Third Parties 201. Minimization (a) Articulated basis A covered entity shall have a reasonable, articulated basis for collecting, processing, maintaining, and disclosing of personal information that takes into account the reasonable business needs of the covered entity and minimum amount of personal information necessary for providing the service, balanced with the intrusion on the privacy of, potential privacy harms to, and reasonable expectations of individuals to whom the personal information relates. (b) Minimization of collecting, processing, maintaining, and disclosing (1) Collecting A covered entity may not collect more personal information than is reasonably needed to provide a product or service that an individual has requested. (2) Processing A covered entity may not process personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity. (3) Maintaining A covered entity may not maintain personal information once such information is no longer needed for the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity. (4) Disclosing A covered entity may not disclose personal information for a purpose other than the purpose for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity. (c) Ancillary collecting, processing, maintaining, and