The privacy policy could easily be that PII will only be used where required by law.

We run in circles avoiding saying that the organization should just do what is required to serve the people it was formed to serve, it's really something.