protect a data subject who is affected by the unauthorised access or acquisition
of data, the Commission may direct the data controller to publicise in the
specified manner, the fact of the compromise to the integrity or confidentiality of
the personal data.
Access to personal information
32. (1) A data subject who provides proof of identity may request a data
controller to
(a) confirm at reasonable cost to the data subject whether or not the
data controller holds personal data about that data subject,
(b) give a description of the personal data which is held by the party
including data about the identity of a third party or a category of a
third party who has or has had access to the information, and
(c) correct data held on the data subject by the data controller.
(2) The request shall be made
(a) within a reasonable time;
(b) after the payment of the prescribed fee, if any;
(c) in a reasonable manner and format; and
(d) in a form that is generally understandable.
Correction of personal data
33. (1) A data subject may request a data controller to
(a) correct or delete personal data about the data subject held by or
under the control of the data controller that is inac- curate,
irrelevant, excessive, out of date, incomplete, misleading or
obtained unlawfully, or
(b) destroy or delete a record of personal data about the data subject
held by the data controller that the data controller no longer has the
authorisation to retain.
(2) On receipt of the request, the data controller shall comply with the
request or provide the data subject with credible evidence in support of the data.
(3) Where the data controller and the data subject are unable to reach an
agreement and if the data subject makes a request, the data con- troller shall
attach to the record an indication that a request for the data has been made but
has not been complied with.
(4) Where the data controller complies with the request, the data
controller shall inform each person to whom the personal data has been
disclosed of the correction made.
(5) The data controller shall notify the data subject of the action taken as
a result of the request.
Manner of access
34. The provisions of any legislation relating to the right to information of
any data subject shall be additional to data subject rights under this Act.