The organisation determines and documents the authority that permits defined collection and use of personal information and restricts collection and use to what is authorized. The GC discussion notes authority comes from laws or Orders in Council, handling must follow the Privacy Act and TBS instruments, notice is usually given at collection, personal information banks and privacy impact assessments are required where information supports decisions, and summaries are published. 2 enhancements. Not allocated to the medium-profile baseline.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.