Also the act restricts the manner in which an institution can collect personal information. With some exceptions, personal information must be collected from the person to whom it relates. When personal information is used, an institution must take reasonable steps to ensure that it is accurate. Restrictions on the use and disclosure of personal information Institutions cannot use or disclose personal information except as permitted in the act. For the most part, personal information can only be used for the purpose for which it was collected or for a consistent purpose.
Individuals have a right to access their own personal records, except under limited circumstances.
If an individual believes that the record is incorrect, he or she can request that the information be corrected. If this is refused, the individual can request that a statement of disagreement be attached to the information. If an affected person, including a third party, disagrees with a decision by an institution relating to the disclosure of a record, or with respect to certain other matters, that person may ask the Information and Privacy Commissioner to review the decision. The commissioner is appointed as an officer of the Legislature and is independent of the government or any institution. If an institution refuses to disclose a record, the commissioner may, on an appeal, independently decide whether or not the record is covered by an exemption.