ACCESS TO INFORMATION AND PROTECTION OF PRIVACY ACT (SHOWING AMENDMENTS MADE BY ACT 5/2003) (3) The head of a public body shall, when correcting or annotating personal information upon a request made in terms of subsection (1), notify the correction to any other public body or any third party to whom that information has been disclosed during the last twelve months preceding the request for a correction. 33 Protection of personal information The head of a public body shall protect personal information that is under his custody or control by taking reasonable steps to ensure that there is adequate security and there is no unauthorised access, collection, use, disclosure or disposal of such personal information. 34 Retention of personal information If a public body uses an individual’s personal information to make a decision that directly affects the individual, the public body shall retain that information for at least one year after using it so that the individual has a reasonable opportunity to have access to it. 35 Penalty for deliberately falsifying personal information21 Any person who, when required under any enactment to supply to a public body any personal information verbally or in writing about himself or herself or a third party, supplies any information which he or she knows to be false or does not have reasonable grounds for believing to be true, shall be guilty of an offence and liable to a fine not exceeding level five or to imprisonment for a period not exceeding six months or to both such fine and such imprisonment. PART VI USE AND DISCLOSURE OF PERSONAL INFORMATION BY PUBLIC BODIES 36 Use of personal information A public body may only use personal information— (a) for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose; or (b) if the person to whom the information relates has consented, in the prescribed manner, to such use.22 37 Disclosure for archival or historical purposes The National Archives, or the archives of a public body, may disclose personal informationto a third party for the purpose of historical research or any other lawful purpose if 23— (a) such disclosure would not result in an unreasonable invasion of a person’s personal privacy in terms of this Act; or (b) the information is about a person who has been deceased for thirty or more years. 21 Section substituted by s. 6 of Act 5/2003. 22 Paragraph amended by s. 25 of as read with Schedule to Act 5/2003. 23 Words substituted by s. 25 of as read with Schedule to Act 5/2003. 21