(1)  A personal information custodian must comply with the personal information protection principles.

(2)  Subsection (1) does not apply to anything done by a personal information custodian before the second anniversary of the commencement of this Act that is necessary for the performance of a contract entered into by the personal information custodian before the commencement of this Act.