Part 3 s 22 (1) (2) (3) (4) (5) (6) Privacy Act 2020 Version as at 6 December 2023 Information privacy principle 7 Correction of personal information An individual whose personal information is held by an agency is entitled to request the agency to correct the information. An agency that holds personal information must, on request or on its own initiative, take such steps (if any) that are reasonable in the circum‐ stances to ensure that, having regard to the purposes for which the infor‐ mation may lawfully be used, the information is accurate, up to date, complete, and not misleading. When requesting the correction of personal information, or at any later time, an individual is entitled to— (a) provide the agency with a statement of the correction sought to the information (a statement of correction); and (b) request the agency to attach the statement of correction to the information if the agency does not make the correction sought. If an agency that holds personal information is not willing to correct the information as requested and has been provided with a statement of cor‐ rection, the agency must take such steps (if any) that are reasonable in the circumstances to ensure that the statement of correction is attached to the information in a manner that ensures that it will always be read with the information. If an agency corrects personal information or attaches a statement of correction to personal information, that agency must, so far as is reason‐ ably practicable, inform every other person to whom the agency has dis‐ closed the information. Subclauses (1) to (4) are subject to the provisions of Part 4. Information privacy principle 8 Accuracy, etc, of personal information to be checked before use or disclosure An agency that holds personal information must not use or disclose that infor‐ mation without taking any steps that are, in the circumstances, reasonable to ensure that the information is accurate, up to date, complete, relevant, and not misleading. Information privacy principle 9 Agency not to keep personal information for longer than necessary An agency that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used. 28