Your Right to Request Correction of Your Personal Information in the Private Sector

Some links on this page take you outside of our web site. To return, please use your web browser's back button.

You Have a Right to Ask for Your Information to be Corrected

You have a right to ask an organization to make a correction to your information. You do not have a right to require the organization to make the correction. The organization can refuse to make the change if it believes (on reasonable grounds) that doing so is not appropriate in the circumstances.
You might be asked to tell the organization the reasonable grounds for making the change. Simple factual errors are unlikely to be controversial (such as a new address).
An organization may be less likely to change information contained in an opinion.

If the organization decides to make the correction, the organization must do so as soon as reasonably possible and must send the corrected personal information to each organization to which the error was disclosed in the prior year. These organizations should also make the correction.

If the organization decides not to make the correction, it must keep a record of the request and make a note on the personal information which the individual requested be corrected, showing the nature of the request.

If Your Request is Clear the Organization Must Respond Within 30 Days
If you make a written request that gives enough detail for the organization to identify you and the information you want, the organization must make a reasonable effort to assist you and to respond as accurately and completely as possible.
Generally, an organization must respond not later than 30 days after receiving the completed, written request, but may extend the time in certain circumstances.

An organization has a duty to assist you when you make a request for access or a request for correction. So if your request doesnt have enough detail the organization may want to work with you to identify the information you want access to or want corrected.
Remember, the 30 day period starts to run when your request is clear enough for the organization to be able to identify the records which contain the personal information you want.

Organizations are required to have procedures in place to receive and respond to complaints and questions about their information-handling practices. The complaint procedures should be easy to access and simple to use. An organization should investigate all complaints, and if it finds a complaint is justified it may take action, including changing its privacy policy and practices, if appropriate.

check the organizations privacy policy to find out if it has a complaints process and if it does, follow it;
if the published policy does not explain the complaint process, try to contact the privacy officer directly and ask him or her any questions that you may have about the process;
it is always a good idea to make a complaint to the organization in writing if you can.

If you have completed the processes offered by the organization and are not satisfied, then you may seek assistance from the relevant Commissioner.
The Privacy Commissioner of Canada and the Information and Privacy Commissioner of BC have slightly different powers.

Design by

Hosted with Love by