Section 8 — Personal Information Protection and Electronic Documents Act: Written request

A request under clause 4.9 of Schedule 1 must be made in writing. An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the organization. An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. An organization may extend the time limit for a maximum of thirty days if meeting the time limit would unreasonably interfere with the activities of the organization, or the time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet; or for the period that is necessary in order to be able to convert the personal information into an alternative format. In either case, the organization shall, no later than thirty days after the date of the request, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit and of their right to make a complaint to the Commissioner in respect of the extension. If the organization fails to respond within the time limit, the organization is deemed to have refused the request. An organization may respond to an individual’s request at a cost to the individual only if the organization has informed the individual of the approximate cost; and the individual has advised the organization that the request is not being withdrawn. An organization that responds within the time limit and refuses a request shall inform the individual in writing of the refusal, setting out the reasons and any recourse that they may have under this Part. Despite clause 4.5 of Schedule 1, an organization that has personal information that is the subject of a request shall retain the information for as long as is necessary to allow the individual to exhaust any recourse under this Part that they may have.