46 guidelines, which require that “[t]he use of intercepted material shall be limited to the minimum that is necessary”. The Act and Rules do not strictly lay down a rule of necessity with respect to either use or collection of information. XXIII. BECAUSE the 2009 IT Rules, specifically Rules 10 and 25(2) do not comply with the principle of purpose limitation, except for the purpose of “investigation” (as specified in Rule 25(2)), inasmuch as there is no restriction on the use of data that is monitored, intercepted, decrypted, or disclosed by/to one of the notified agencies/Central/State Government by any of the other agencies or by the State or Central Government. XXIV. BECAUSE under the 2009 IT Rules, there is no consequence of illegally intercepting, monitoring, or decrypting personal information, nor is there any mandatory requirement for setting aside such orders in case they do not adhere to the prescribed procedure and safeguards mandated under Section 69(2) read with the IT Rules. Under Rule 9 of the 2009 IT Rules, even if the Review Committee gives a finding that the directions issued under Rule 3 are not in accordance with Section 69(2) of the Act, it “may” (not shall) set aside these directions and issue orders for the destruction of the copies. E. XXV. ABSENCE OF DUE PROCESS BECAUSE the decision to intercept, monitor, decrypt or disclose information collected under Section 69 of the IT Act and the 2009 IT Rules lack any due process, and are thus unconstitutional. This Hon’ble Court in Puttaswamy