for which such information was originally collected from the individual or in the case of a service provider, a purpose other than that which is in accordance with the directions of a covered entity. (c) Ancillary collecting, processing, maintaining, and disclosing Notwithstanding subsection (b), a covered entity may collect, process, disclose, or maintain personal information beyond limitations under subsection (b) only if such covered entity complies with this subsection. (1) No notice or consent required A covered entity may collect, process, or maintain personal information without additional notice or consent if the purpose for such collecting, processing, or maintaining is substantially similar to the type of personal information and purpose for which such personal information was originally collected and such ancillary collecting, processing, or maintaining will not result in additional or increased privacy harms. (2) Notice required A covered entity shall provide notice of ancillary collecting, processing, maintaining, or disclosing of personal information in the case of one, but not more than one, of the following instances: (A) Such ancillary collecting, processing, maintaining, or disclosing may result in additional or increased privacy harms (but not increased significant privacy harms), and is substantially similar to the purpose for which such personal information was originally collected. (B) Such ancillary collecting, processing, maintaining, or disclosing is not substantially similar to the purpose for which such personal information was originally collected, but will not result in additional or increased privacy harms. (C) Such ancillary collecting, processing, maintaining, or disclosing may result in additional or increased privacy harms (but not increased significant privacy harms) and the purpose is not substantially similar to the purpose for which such personal information was originally collected, so long as the personal information is secured using privacy-preserving computing. (3)