Let’s recap. The Privacy Act gives people the right to access their information. And when a person requests their information, the organisation or business must respond to the request within 20 working days.
If yours is a small business or organisation, there’s every chance you may be fairly inexperienced in what to do if you receive a request for personal information. But we hope you are at least aware that the Privacy Act gives people the right to make a request for information that is about them.
Organisations sometimes get it wrong when they respond to a person’s request for their personal information. Information is sometimes lost, displaced or accidentally deleted. A recent privacy case dealt with by the Human Rights Review Tribunal considers when an organisation can call it quits when it comes to searching for personal information in responding to an access request.
We live in an age where agencies collect and hold a lot of information about us. When we then request access to that information, this places demands on the time and resources of agencies to meet their obligations under the Privacy Act. Agencies sometimes feel a bit overwhelmed when responding to requests for personal information - especially where a high volume of information is held.