- ensure the confidentiality - integrity - and availability of personally identifiable information created - collected - used - and/or disclosed by the exchange - personally identifiable information that may only be used by or disclosed to those authorized to receive or view it - return information must be kept confidential - personally identifiable information is protected against any reasonably anticipated threats or hazards to the confidentiality - integrity - and availability of such information - personally identifiable information is securely destroyed or disposed of in an appropriate and reasonable manner