COLLECTION, USE, OR RETENTION OF DATA FOR CERTAIN PURPOSES.

(a) The requirements imposed on controllers and processors under this chapter may not restrict a controller's or processor's ability to collect, use, or retain data to:

(1) conduct internal research to develop, improve, or repair products, services, or technology;

(2) effect a product recall;

(3) identify and repair technical errors that impair existing or intended functionality; or

(4) perform internal operations that:

(A) are reasonably aligned with the expectations of the consumer;

(B) are reasonably anticipated based on the consumer's existing relationship with the controller; or

(C) are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party.

(b) A requirement imposed on a controller or processor under this chapter does not apply if compliance with the requirement by the controller or processor, as applicable, would violate an evidentiary privilege under the laws of this state.