49.12 (1) The Commissioner may conduct a review of the practices and procedures of a multi-sector data integration unit or a ministry data integration unit if the Commissioner has reason to believe that the requirements of this Part are not being complied with. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (1). Mandatory review of inter-ministerial data integration unit (2) The Commissioner shall conduct a review of the practices and procedures of a multi-sector data integration unit in order to determine if they comply with the requirements under this Part, (a) after the unit is designated; and (b) as otherwise necessary to ensure that a review of the practices and procedures is conducted at least once every three years. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (1). Same (2.1) The Commissioner may determine that a review of the practices and procedures of an extra-ministerial data integration unit conducted by the Commissioner under the Personal Health Information Protection Act, 2004 is satisfactory, in whole or in part, for the purposes of subsection (2) and shall notify the senior officer of the extra-ministerial data integration of this determination. 2020, c. 5, Sched. 2, s. 11 (2). Conduct of review (3) In conducting a review referred to in subsection (1), the Commissioner shall review the practices and procedures of the multi-sector data integration unit or the ministry data integration unit, as the case may be, to determine whether, (a) there has been unauthorized collection, retention, use, disclosure, access to or modification of personal information collected under this Part; and (b) the requirements under this Part, including requirements with respect to notice, de-identification, retention, security and secure disposal, have been met. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (3). Duty to assist (4) Members of the inter-ministerial data integration unit, extra-ministerial data integration unit or the ministry data integration unit and the minister of the ministry in which the unit is located or the senior officer of the extra-ministerial data integration unit shall co-operate with and assist the Commissioner in the conduct of the review. 2020, c. 5, Sched. 2, s. 11 (4). Powers of Commissioner (5) The Commissioner may require the production of such information and records that are relevant to the subject matter of the review and that are in the custody or under the control of, (a) in the case of an inter-ministerial data integration unit or a ministry data integration unit, the ministry in which the unit is located; (b) in the case of an extra-ministerial data integration unit, the unit or the person or entity in which the unit is located, as the case may be; (c) an institution, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a person or an entity that has disclosed personal information to the inter-ministerial data integration unit, extra-ministerial data integration unit or the ministry data integration unit, as the case may be, under this Part; or (d) an institution, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a person or entity to whom a member of the inter-ministerial data integration unit, extra-ministerial data integration unit or the ministry data integration unit has disclosed personal information under this Part. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (5). Same (6) A member of an inter-ministerial data integration unit or a ministry data integration unit, the minister of the ministry in which the unit is located, a member of an extra-ministerial data integration unit and its senior officer, the head of an institution referred to in clause (5) (c) or (d), the administrative head of any person or entity referred to in either of those clauses and any person referred to in either of those clauses who is an individual shall provide the Commissioner with whatever assistance is reasonably necessary for the conduct of the review, including using any data storage processing or retrieval device or system to produce a record required by the Commissioner in readable form. 2020, c. 5, Sched. 2, s. 11 (6). Orders (7) If, after giving an opportunity to be heard to the minister of the ministry in which the inter-ministerial data integration unit or the ministry data integration unit is located or the senior officer of the extra-ministerial data integration unit, as the case may be, the Commissioner determines that a practice or procedure contravenes this Part, the Commissioner may order the unit to do any of the following: 1. Discontinue the practice or procedure. 2. Change the practice or procedure as specified by the Commissioner. 3. Destroy personal information collected or retained under the practice or procedure. 4. Implement a new practice or procedure as specified by the Commissioner. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (7). Limit on certain orders (8) The Commissioner may order under subsection (7) no more than what is reasonably necessary to achieve compliance with this Part. 2019, c. 7, Sched. 31, s. 6. Procedure (9) The Statutory Powers Procedure Act does not apply to a review conducted under this section. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 11 (1-7) - 25/03/2020