An APP entity must take active measures to ensure the security of personal information it holds and consider if it is permitted to retain personal information.