The privacy notice stated that the sensitive information would be collected "primarily from individuals directly where voluntarily provided to us, but HS2 may also collect personal data, where lawful to do so, from (and combine it with information from) online sources and/or other third parties.