If an organization determines that access should be denied in any particular instance, it should provide the individual requesting access with an explanation of why it has made that determination and a contact point for any further inquiries. The particular computer program an organization uses, such as a modeling program, or the details of that program may be confidential commercial information. Where confidential commercial information can be readily separated from other information subject to an access request, the organization should redact the confidential commercial information and make available the non-confidential information. Organizations may deny or limit access to the extent that granting it would reveal its own confidential commercial information as defined above, such as marketing inferences or classifications generated by the organization, or the confidential commercial information of another where such information is subject to a contractual obligation of confidentiality in circumstances where such an obligation of confidentiality would normally be undertaken or imposed. Access can be provided in the form of disclosure by an organization to the individual and does not require access by the individual to an organization's data base.
Access needs to be provided only to the extent that an organization stores the information.
The access principle does not itself create any obligation to retain, maintain, reorganize, or restructure personal information files. These replies make clear that access may be denied in certain circumstances. Such circumstances are limited, and any reasons for denying access must be specific. In addition, where personal information is processed solely for research or statistical purposes, access may be denied. As noted above, the reasons for denying or limiting access and a contact point for further inquires should be given to individuals.