Privacy Regulations (SOR/83-508)

4 (1) Personal information concerning an individual that has been used by a government institution for an administrative purpose shall be retained by the institution

• (a) for at least two years following the last time the personal information was used for an administrative purpose unless the individual consents to its disposal; and

• (b) where a request for access to the information has been received, until such time as the individual has had the opportunity to exercise all his rights under the Act.

(2) Notwithstanding subsection (1) where personal information is under the control of a government institution at a post abroad, the head of the post or the senior officer in charge thereof may order the destruction of the information in an emergency in order to prevent the removal of the information from the control of the institution.

(3) [Revoked, SOR/88-123, s. 1]