ACCESS TO INFORMATION AND PROTECTION OF PRIVACY ACT (SHOWING AMENDMENTS MADE BY ACT 5/2003) (2) A public body shall inform a person from whom it intends to collect personal information of the purpose for which the personal information is being collected and the legal authority for collecting it. (3) Subsection (2) shall not apply if— (a) the information relates to law enforcement; or (b) the Commission excuses a public body from complying with the subsection if doing so would result in the collection of inaccurate information, or defeat the purpose of, or prejudice the use for which, the information is to be collected. 31 Accuracy of personal information A public body shall, if it intends to use an individual’s personal information to make a decision that will directly affect that individual, take every reasonable step to ensure that the information is accurate and complete. 32 Right to request correction of personal information (1) Where a person has reason to believe that personal information relating to him that is in the custody or control of a public body contains an error or omission, he may request the head of that public body to correct such information. (2) The head of a public body shall, upon receiving a request in terms of subsection (1), correct or annotate the personal information on the record pertaining to the person making the request. (3) The head of a public body shall, when correcting or annotating personal information upon a request made in terms of subsection (1), notify the correction to any other public body or any third party to whom that information has been disclosed during the last twelve months preceding the request for a correction. 33 Protection of personal information The head of a public body shall protect personal information that is under his custody or control by taking reasonable steps to ensure that there is adequate security and there is no unauthorised access, collection, use, disclosure or disposal of such personal information. 34 Retention of personal information If a public body uses an individual’s personal information to make a decision that directly affects the individual, the public body shall retain that information for at least one year after using it so that the individual has a reasonable opportunity to have access to it. 35 Penalty for deliberately falsifying personal information 23 Any person who, when required under any enactment to supply to a public body any personal information verbally or in writing about himself or herself or a third party, supplies any information which he or she knows to be false or does not have reasonable grounds for believing to be true, shall be guilty of an offence and liable to a fine not exceeding level five or to imprisonment for a period not exceeding six months or to both such fine and such imprisonment. 23 Section substituted by s. 6 of Act 5/2003. 21