Exercising your rights
Each right has its own process:
- Access: write to the organization's privacy officer with proof of identity.
- Correction: identify the inaccuracy and provide supporting evidence.
- Portability: request information in a commonly used technological format.
- De-indexing: request removal of specific links where their continued publication causes serious harm.
- Automated decision review: request a human review of any significant automated decision.
Timelines
Organizations must respond within 30 days. If they refuse, they must give written reasons. If you do not receive a response or are unsatisfied, you can apply to the CAI.
CAI complaints and penalties
Complaints can be filed online with the CAI. The CAI can investigate, order corrective action, and impose administrative monetary penalties.
Penalties can reach $10 million or 2% of worldwide turnover for administrative violations, and $25 million or 4% for criminal violations.
Privacy impact assessments for organizations
Law 25 requires organizations to conduct a PIA for any system involving personal information. If you are an organization needing help, you may want to engage privacy counsel.