; (2) until consent is revoked; and (3) one or more additional durations based on reasonable expectations and norms for maintaining the category of personal information. (c) Exception for implied consent Where the long-term maintaining of personal information is, on its face, obvious and a core feature of the product or service at the request of the individual, and the personal information is maintained only to provide such product or service, subsections (a) and (b) shall not apply. 109. Exemptions, exceptions, fees, timelines, and rules of construction for rights under this title (a) Exemptions for personal information for particular purposes (1) In general This title does not apply with respect to personal information that is collected, processed, maintained, or disclosed for any of the following purposes (or a combination of such purposes), where a covered entity has technical safeguards and business processes that limit collecting, processing, maintaining, or disclosing of such personal information to the following purposes: (A) Detecting, responding to, or preventing security incidents or threats. (B) Protecting against malicious, deceptive, fraudulent, or illegal activity. (C) A good faith response to, or compliance with, a valid subpoena, court order, or warrant (including a subpoena and court order obtained by an entity that is not a government entity) or otherwise providing information as required by law. (D) Protecting a legally recognized privilege or other legal right. (E) Protecting public safety. (F) Collecting, processing, or maintaining by an employer pursuant to an employer-employee relationship of records about employees or employment status, except— (i) where the information would not be reasonably expected to be collected in the context of an employee’s regular duties