(b) for the period that is necessary in order to be able to convert the personal information into an alternative format.

In either case, the organization shall, no later than thirty days after the date of the request, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit and of their right to make a complaint to the Commissioner in respect of the extension.

Deemed refusal

(5) If the organization fails to respond within the time limit, the organization is deemed to have refused the request.

Costs for responding

(6) An organization may respond to an individual's request at a cost to the individual only if

    (a) the organization has informed the individual of the approximate cost; and

    (b) the individual has advised the organization that the request is not being withdrawn.

Reasons

(7) An organization that responds within the time limit and refuses a request shall inform the individual in writing of the refusal, setting out the reasons and any recourse that they may have under this Part.

Retention of information

(8) Despite clause 4.5 of Schedule 1, an organization that has personal information that is the subject of a request shall retain the information for as long as is necessary to allow the individual to exhaust any recourse under this Part that they may have.

When access prohibited

9. (1) Despite clause 4.9 of Schedule 1, an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party. However, if the information about the third party is severable from the record containing the information about the individual, the organization shall sever the information about the third party before giving the individual access.

Limit

(2) Subsection (1) does not apply if the third party consents to the access or the individual needs the information because an individual's life, health or security is threatened.

Information related to paragraphs 7(3)(c), (c.1) or (d)

(2.1) An organization shall comply with subsection (2.2) if an individual requests that the organization

    (a) inform the individual about

      (i) any disclosure of information to a government institution or a part of a government institution under paragraph 7(3)(c), subparagraph 7(3)(c.1)(i) or (ii) or paragraph 7(3)(d), or

      (ii) the existence of any information that the organization has relating to a disclosure referred to in subparagraph (i), to a subpoena, warrant or order referred to in paragraph 7(3)(c) or to a request made by a government institution or a part of a government institution under subparagraph 7(3)(c.1)(i) or (ii); or

    (b) give the individual access to the information referred to in subparagraph (a)(ii).

Notification and response

(2.2) An organization to which subsection (2.1) applies

    (a) shall, in writing and without delay, notify the institution or part concerned of the request made by the individual; and

    (b) shall not respond to the request before the earlier of

      (i) the day on which it is notified under subsection (2.3), and

      (ii) thirty days after the day on which the institution or part was notified.

Objection

(2.3) Within thirty days after the day on which it is notified under subsection (2.2), the institution or part shall notify the organization whether or not the institution or part objects to the organization complying with the request. The institution or part may object only if the institution or part is of the opinion that compliance with the request could reasonably be expected to be injurious to

    (a) national security, the defence of Canada or the conduct of international affairs; or

    (b) the enforcement of any law of Canada, a province or a foreign jurisdiction, an investigation relating to the enforcement of any such law or the gathering of intelligence for the purpose of enforcing any such law.

Prohibition

(2.4) Despite clause 4.9 of Schedule 1, if an organization is notified under subsection (2.3) that the institution or part objects to the organization complying with the request, the organization

    (a) shall refuse the request to the extent that it relates to paragraph (2.1)(a) or to information referred to in subparagraph (2.1)(a)(ii);

    (b) shall notify the Commissioner, in writing and without delay, of the refusal; and

    (c) shall not disclose to the individual

      (i) any information that the organization has relating to a disclosure to a government institution or a part of a government institution under paragraph 7(3)(c), subparagraph 7(3)(c.1)(i) or (ii) or paragraph 7(3)(d) or to a request made by a government institution or a part of a government institution under either of those subparagraphs,

      (ii) that the organization notified an institution or part under paragraph (2.2)(a) or the Commissioner under paragraph (b), or

      (iii) that the institution or part objects.

When access may be refused

(3) Despite the note that accompanies clause 4.9 of Schedule 1, an organization is not required to give access to personal information only if

    (a) the information is protected by solicitor-client privilege;

    (b) to do so would reveal confidential commercial information;

    (c) to do so could reasonably be expected to threaten the life or security of another individual;

    (c.1) the information was collected under paragraph 7(1)(b); or

    (d) the information was generated in the course of a formal dispute resolution process.

However, in the circumstances described in paragraph (b) or (c), if giving access to the information would reveal confidential commercial information or could reasonably be expected to threaten the life or security of another individual, as the case may be, and that information is severable from the record containing any other information for which access is requested, the organization shall give the individual access after severing.

Limit

(4) Subsection (3) does not apply if the individual needs the information because an individual's life, health or security is threatened.

Notice

(5) If an organization decides not to give access to personal information in the circumstances set out in paragraph (3)(c.1), the organization shall, in writing, so notify the Commissioner, and shall include in the notification any information that the Commissioner may specify.

Sensory disability

10. An organization shall give access to personal information in an alternative format to an individual with a sensory disability who has a right of access to personal information under this Part and who requests that it be transmitted in the alternative format if

    (a) a version of the information already exists in that format; or

    (b) its conversion into that format is reasonable and necessary in order for the individual to be able to exercise rights under this Part.

DIVISION 2

REMEDIES

Filing of Complaints

Contraven-
tion

11. (1) An individual may file with the Commissioner a written complaint against an organization for contravening a provision of Division 1 or for not following a recommendation set out in Schedule 1.

Commissioner may initiate complaint

(2) If the Commissioner is satisfied that there are reasonable grounds to investigate a matter under this Part, the Commissioner may initiate a complaint in respect of the matter.

Time limit

(3) A complaint that results from the refusal to grant a request under section 8 must be filed within six months, or any longer period that the Commissioner allows, after the refusal or after the expiry of the time limit for responding to the request, as the case may be.

Notice

(4) The Commissioner shall give notice of a complaint to the organization against which the complaint was made.

Investigations of Complaints

Powers of Commissioner

12. (1) The Commissioner shall conduct an investigation in respect of a complaint and, for that purpose, may

    (a) summon and enforce the appearance of persons before the Commissioner and compel them to give oral or written evidence on oath and to produce any records and things that the Commissioner considers necessary to investigate the complaint, in the same manner and to the same extent as a superior court of record;

    (b) administer oaths;

    (c) receive and accept any evidence and other information, whether on oath, by affidavit or otherwise, that the Commissioner sees fit, whether or not it is or would be admissible in a court of law;

    (d) at any reasonable time, enter any premises, other than a dwelling-house, occupied by an organization on satisfying any security requirements of the organization relating to the premises;

    (e) converse in private with any person in any premises entered under paragraph (d) and otherwise carry out in those premises any inquiries that the Commissioner sees fit; and

    (f) examine or obtain copies of or extracts from records found in any premises entered under paragraph (d) that contain any matter relevant to the investigation.

Dispute resolution mechanisms

(2) The Commissioner may attempt to resolve complaints by means of dispute resolution mechanisms such as mediation and conciliation.

Delegation

(3) The Commissioner may delegate any of the powers set out in subsection (1) or (2).

Return of records

(4) The Commissioner or the delegate shall return to a person or an organization any record or thing that they produced under this section within ten days after they make a request to the Commissioner or the delegate, but nothing precludes the Commissioner or the delegate from again requiring that the record or thing be produced.

Certificate of delegation

(5) Any person to whom powers set out in subsection (1) are delegated shall be given a certificate of the delegation and the delegate shall produce the certificate, on request, to the person in charge of any premises to be entered under paragraph (1)(d).

Commissioner's Report

Contents

13. (1) The Commissioner shall, within one year after the day on which a complaint is filed or is initiated by the Commissioner, prepare a report that contains

    (a) the Commissioner's findings and recommendations;

    (b) any settlement that was reached by the parties;

    (c) if appropriate, a request that the organization give the Commissioner, within a specified time, notice of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken; and

    (d) the recourse, if any, that is available under section 14.

Where no report

(2) The Commissioner is not required to prepare a report if the Commissioner is satisfied that

    (a) the complainant ought first to exhaust grievance or review procedures otherwise reasonably available;

    (b) the complaint could more appropriately be dealt with, initially or completely, by means of a procedure provided for under the laws of Canada, other than this Part, or the laws of a province;

    (c) the length of time that has elapsed between the date when the subject-matter of the complaint arose and the date when the complaint was filed is such that a report would not serve a useful purpose; or

    (d) the complaint is trivial, frivolous or vexatious or is made in bad faith.

If a report is not to be prepared, the Commissioner shall inform the complainant and the organization and give reasons.

Report to parties

(3) The report shall be sent to the complainant and the organization without delay.

Hearing by Court

Application

14. (1) A complainant may, after receiving the Commissioner's report, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner's report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by Division 1, in subsection 5(3) or 8(6) or (7) or in section 10.

Time of application

(2) The application must be made within forty-five days after the report is sent or within any further time that the Court may, either before or after the expiry of those forty-five days, allow.

For greater certainty

(3) For greater certainty, subsections (1) and (2) apply in the same manner to complaints referred to in subsection 11(2) as to complaints referred to in subsection 11(1).

Commissioner may apply or appear

15. The Commissioner may, in respect of a complaint that the Commissioner did not initiate,

    (a) apply to the Court, within the time limited by section 14, for a hearing in respect of any matter described in that section, if the Commissioner has the consent of the complainant;

    (b) appear before the Court on behalf of any complainant who has applied for a hearing under section 14; or

    (c) with leave of the Court, appear as a party to any hearing applied for under section 14.

Remedies

16. The Court may, in addition to any other remedies it may give,

    (a) order an organization to correct its practices in order to comply with sections 5 to 10;

    (b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph (a); and

    (c) award damages to the complainant, including damages for any humiliation that the complainant has suffered.

Summary hearings

17. (1) An application made under section 14 or 15 shall be heard and determined without delay and in a summary way unless the Court considers it inappropriate to do so.

Precautions

(2) In any proceedings arising from an application made under section 14 or 15, the Court shall take every reasonable precaution, including, when appropriate, receiving representations ex parte and conducting hearings in camera, to avoid the disclosure by the Court or any person of any information or other material that the organization would be authorized to refuse to disclose if it were requested under clause 4.9 of Schedule 1.