See comments §A.5.a. David Ross clarifies: "In both cases, "legal mandates" refers to statutory laws that require personal data to be kept private, that mandate disclosure of such data, or that make privacy and disclosure a business decision by the CA."