The organization has failed to correct personal information as requested by
an individual, or, where it disagrees with the requested correction, has not placed a notation on
the information indicating the substance of the disagreement.
An organization has required more than a minimal fee for providing individuals with access
to their personal information.
An organization has failed to make readily available to individuals specific information
about its policies and practices relating to the management of personal information.
Personal information is retained longer than necessary for the fulfillment of the
purposes that an organization stated when it collected the information, or, if it has been used to
make a decision about an individual, has not been retained long enough to allow the individual
access to the information.
An organization has failed to protect personal information with appropriate security
An organization has failed to provide an individual with access to his or her personal
information within the time limits set out in the
Use and disclosure.
Personal information is used or disclosed for purposes other than those for
which it was collected, without the consent of the individual, and the use or disclosure without
consent is not one of the permitted exceptions in the