Whose practices may the Personal Information Protection Commission ask to be improved, and what must a handler receiving such a recommendation then do and report?
General information · Not legal advice
Material to check
In a practice file of this kind, we read the notice of recommendation, which names the Personal Information Protection Commission, the handler it was sent to, and the practices to be improved; we also read the handler's record of the steps taken in response and the paper by which it told the Commission the outcome of those measures.
These are types of material to look for, not evidence already verified by PRO SE.
Where readings differ
One reading takes the provision at its word: where the Personal Information Protection Commission considers a recommendation necessary for the protection of personal information, it may recommend improvement of a personal information handler's practices, and a handler that receives the recommendation must make sincere efforts to carry it out and must tell the Commission the result of its measures.
Another reading notes that the provision attaches the recommendation to the Commission's own finding that it is 'necessary', and sets no application, no prior finding of a breach, and no period or content for the handler's report, so what the file must show is only that the Commission formed that view, that the notice reached an entity acting as a personal information handler, and that a report of measures reached the Commission.
Your judgment
Given the measures a handler took, how could the file show whether those measures answer the practices the recommendation named?
PRO SE does not make this decision or keep a case record on this public site.When to reconsider
We look at this again if the provision is amended to set a period, a form or a content for the handler's report, or if a Commission or court decision clarifies what makes efforts sincere or which entities count as personal information handlers.