When customers make a request in writing, the Scotiabank Group Member will within a reasonable time tell them what personal information the Scotiabank Group Member has, what it is being used for, and to whom it has been disclosed.

When customers request it in writing, the Scotiabank Group Member will give them access to their personal information. The Scotiabank Group Member will respond to the written customer request in a timely fashion. In certain situations, however, the Scotiabank Group Member may not be able to give customers access to all their personal information. The Scotiabank Group Member will explain the reasons for this lack of access and any recourse the customer may have, except where prohibited by law.

9.1  A customer has the right to know, by written request, what personal information is held by the Scotiabank Group Member. Customers have a right, upon written request, to access personal information, and to know to which third parties the information has been disclosed.

9.2  The Scotiabank Group Member has policies and procedures for responding to customers' requests for access to personal information. When customers ask, the Scotiabank Group Member will make these policies and procedures known to the customers. To respond to a customer's request certain information may be required, for example, customers have to be specific about the type of personal information that may be held by the Scotiabank Group Member and the branch or office through which the customer deals.

9.3  The Scotiabank Group Member will attempt to be as specific as possible about the persons from whom it collected the personal information, to whom it has disclosed the personal information, and how and when the information was disclosed. The Scotiabank Group Member will take this information from its records, and will provide it to the customer in a form that is generally easy to understand, providing explanations for abbreviations and codes. The Scotiabank Group Member will provide the personal information to the customer within a reasonable time, and for a cost commensurate with the effort to retrieve the information, or at no cost.

9.3.1  The Scotiabank Group Member will not charge the customer without first informing the customer of the cost of providing the personal information and giving the customer the option to withdraw the request.

9.3.2  On request, the Scotiabank Group Member will give a customer, who has a sensory disability, access to personal information to which the customer is entitled, in an alternative format if a version of the information already exists in the alternative format, or if conversion into that format is reasonable and necessary in order for the customer to access the personal information.

9.4  The Scotiabank Group Member will not provide the personal information that is in its control if

• In so doing, it would reveal personal information about a third party and such personal information is not severable from the requesting individual's personal information.
• It is subject to solicitor-client or litigation privilege.
• It contains the Scotiabank Group Member's own confidential commercial information and such confidential commercial information is not severable from the requesting individual's personal information. For example, the Scotiabank Group Member may use a scoring formula, form an assessment of risk, or make a collection recommendation that is confidential to the Scotiabank Group Member.
• In so doing, it would reveal information that would reasonably be expected to threaten the life or security of another individual and such information is not severable from the requesting individual's personal information.
• It is information that was generated in the course of a formal dispute resolution process.
• It cannot be disclosed for legal reasons. For example, the Scotiabank Group Member may not legally be able to provide the customer with information relating to disclosures to lawful authorities for law enforcement or crime prevention purposes. In some provinces the Scotiabank Group Member cannot legally provide a customer's credit bureau report to that customer.
• It is used for the detection and prevention of criminal activity and dealings in proceeds of crime.

9.5  The Scotiabank Group Member will not record in customers' individual files when personal information was disclosed to third parties for routine purposes. For example:

• Cheque printing and other services for the Scotiabank Group Member.
• Reporting to Canada Customs and Revenue Agency (T5 and other reports).
• Regular updating of credit information to credit bureaus.
• Indicating to third parties when cheques are returned for NSF (not sufficient funds).
• Underwriting and /or insurance claims processing.
• Insurance premium payments.
• Preparation and mailing of customer statements.
• Record keeping for settlement of investment positions and transactions.

9.6  If the Scotiabank Group Member denies the customer's request for access to personal information, the Scotiabank Group Member will tell the customer why except where prohibited by law. The customer may then challenge the Scotiabank Group Member's decision. See Principle 10.

9.7  A customer may challenge the reasonableness of the cost of providing personal information.