29.182 The ALRC recommends a number of changes to the ‘Access and Correction’ principle. These changes impose new obligations on agencies and organisations, including an obligation to respond to a request for access in a timely manner and, in certain circumstances, to notify third parties of a correction to personal information. The ALRC recommends some changes to access and correction requirements to allow a unified ‘Access and Correction’ principle for agencies and organisations. Agencies and organisations will benefit from clear guidance on how these changes should be applied.
Recommendation 29-9 The Office of the Privacy Commissioner should develop and publish guidance on the ‘Access and Correction’ principle, including:
(a) when personal information is ‘held’ by an agency or organisation;
(b) the requirement that access to personal information should be provided to the maximum extent possible consistent with relevant exceptions;
(c) the factors that an agency or organisation should take into account when determining what is a reasonable period of time to respond to a request for access;
(d) the factors that an agency or organisation should take into account in determining when it would be reasonable and practicable to notify other entities to which it has disclosed personal information of a correction to this information; and
(e) the interrelationships between access to, and correction of, personal information under the Privacy Act and other Commonwealth laws, in particular, those relating to freedom of information.