Duty of public bodies to establish information practices
2017, c.31, s.50
48.1(1)A public body shall establish information practices to ensure compliance with this Act and shall protect personal information by making reasonable security arrangements against unauthorized access, use, disclosure or disposal, in accordance with the regulations.
48.1(2)If a public body uses personal information about an individual to make decisions that directly affects the individual, the public body shall, subject to any other Act of the Legislature,
(a)
retain the personal information for a reasonable period of time so that the individual to whom the information relates has a reasonable opportunity to obtain access to it, and
(b)
establish a written information practice to that effect including any additional requirements prescribed by regulation.
48.1(3)A regulation prescribing requirements respecting information practices may include any terms, conditions, prohibitions or restrictions relating to the collection, use, disclosure, retention, correction or disposal of personal information.
48.1(4)A public body shall designate an officer or employee of the public body or an officer or employee of another public body to
(a)
assist in ensuring the public body’s compliance with this Act,
(b)
respond to inquiries about the public body’s information practices,
(c)
make information about the public body’s information practices available to the public, and
(d)
receive complaints from the public about any alleged contravention of this Act or the regulations under this Act by the public body.