Section 9 — Privacy Act: Record of disclosures to be retained

The head of a government institution shall retain a record of any use by the institution of personal information contained in a personal information bank or any use or purpose for which that information is disclosed by the institution where the use or purpose is not included in the statements of uses and purposes set forth pursuant to subparagraph 11(1)(a)(iv) and subsection 11(2) in the index referred to in section 11, and shall attach the record to the personal information. Subsection (1) does not apply in respect of information disclosed pursuant to paragraph 8(2)(e). For the purposes of this Act, a record retained under subsection (1) shall be deemed to form part of the personal information to which it is attached. Where personal information in a personal information bank under the control of a government institution is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the institution but the use is not included in the statement of consistent uses set forth pursuant to subparagraph 11(1)(a)(iv) in the index referred to in section 11, the head of the government institution shall forthwith notify the Privacy Commissioner of the use for which the information was used or disclosed; and ensure that the use is included in the next statement of consistent uses set forth in the index.