The organisation establishes procedures for and keeps a record of disclosures of personal information, with the date and details and the recipient's position and contact information, retains it as long as the information is kept or as information management standards require, and makes it available to the individual on request unless a Privacy Act exemption applies. Canada-specific addition: a contract, information sharing agreement or arrangement documenting safeguards is established before any disclosure to another federal program or public or private entity. No enhancements. Deployed organisation-wide in the medium profile.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.