US states codifying obligations to maintain personal data inventories and retention schedules, to limit retention use to only what is necessary to meet the purposes disclosed at the point and time of collection, for only so long as that limited purpose continues.