Access and correction obligations

59.3 The ‘Access and Correction’ principle in the model UPPs provides that, subject to a range of exceptions:

If an agency or organisation holds personal information about an individual and the individual requests access to the information, it must respond within a reasonable time and provide the individual with access to the information …

59.4 The ‘Access and Correction’ principle also provides that if an organisation charges for providing access to personal information, those charges must not be excessive and must not apply to lodging a request for access.

59.5 Part IIIA contains similar provisions relating to personal information in credit information files and credit reports. Section 18H provides that credit reporting agencies and credit providers must take reasonable steps to ensure that individuals can obtain access to such files and reports.

59.6 There are, however, significant differences between the rights of access in s 18H and the ‘Access and Correction’ principle. These include the absence of exceptions to the rights of access in s 18H and the fact that, while the principle (like National Privacy Principle (NPP) 6.4) provides that access charges ‘must not be excessive’, s 18H is silent on charging of fees for access.

59.7 In relation to obligations to correct personal information, the ‘Access and Correction’ principle provides that an organisation must take such steps, if any, as are reasonable to correct the information so that it is, with reference to a purpose for which it is held, misleading or not accurate, complete, up-to-date and relevant. The principle also provides that other entities to whom the personal information has already been disclosed be notified, if requested to do so by the individual, and provided such notification would be practicable in the circumstances.

59.8 Further, if an individual and an agency or organisation disagree about whether personal information is, with reference to a purpose for which the information is held, misleading or not accurate, complete, up-to-date or relevant, the individual may ask for a correcting statement to be associated with the information.

59.9 Section 18J(1) contains similar provisions requiring credit reporting agencies and credit providers to take reasonable steps to correct credit information files or credit reports to ensure these are accurate, up‑to‑date, complete and not misleading. In addition, s 18J(2) contains specific provisions dealing with the inclusion of correcting statements, on the request of an individual.^[2]