413Making individuals aware of personal information held

413 Making individuals aware of personal information held (1) An intelligent access program service provider must prepare, and make publicly available, a document setting out the service provider’s policies on the management of personal information held by the service provider. Examples of how a document is made publicly available— • making a document available at the service provider’s office • making a document available on the service provider’s website

(2) If asked by an individual about whom an intelligent access program service provider holds personal information, the service provider must, within 28 days after receiving the request, give the individual the following information if the service provider can reasonably give the information— (a) the kind of information the service provider holds about the individual; (c) the way in which the service provider collects, holds, uses and discloses the information; (d) the entities to whom the information may be disclosed; (e) that, under this Chapter, the individual has rights of access to the (f) how the rights mentioned in paragraph (e) can be exercised. (3) Subsection (2) does not require an intelligent access program service provider to inform an individual that a report under section 422 or 423 exists or has been made.