Section 36 — Privacy Act: Investigation of exempt banks

The Privacy Commissioner may, from time to time at the discretion of the Commissioner, carry out investigations of the files contained in personal information banks designated as exempt banks under section 18. Sections 31 to 34 apply, where appropriate and with such modifications as the circumstances require, in respect of investigations carried out under subsection (1). If, following an investigation under subsection (1), the Privacy Commissioner considers that any file contained in a personal information bank should not be contained therein within the terms of the order designating the bank as an exempt bank, the Commissioner shall provide the head of the government institution that has control of the bank with a report containing the findings of the Commissioner and any recommendations that the Commissioner considers appropriate; and where appropriate, a request that, within a time specified therein, notice be given to the Commissioner of any action taken or proposed to be taken to implement the recommendations or reasons why no such action has been or is proposed to be taken. Any report made by the Privacy Commissioner under subsection (3), together with any notice given to the Commissioner in response thereto, may be included in a report made pursuant to section 38 or 39. Where the Privacy Commissioner requests a notice under paragraph (3)(b) in respect of any file contained in a personal information bank designated under section 18 as an exempt bank and no notice is received within the time specified therefor or the action described in the notice is, in the opinion of the Commissioner, inadequate or inappropriate or will not be taken in a reasonable time, the Privacy Commissioner may make an application to the Court under section 43.