When collecting personal data, institutions must let the data subject know the purposes and uses of the data collected. Such information can be provided via a personal data collection statement. However, institutions should avoid having personal data of different persons registered on the same piece of paper, or they should take precautions to prevent other people from viewing the personal data of a data subject.