Sec. 5. If the data subject gives notice that the data subject wishes to challenge, correct, or explain information about the data subject in the personal information system, the following minimum procedures shall be followed:

(a) the agency maintaining the information system shall investigate and record the current status of that personal information;

(b) if, after the investigation, the information is found to be incomplete, inaccurate, not pertinent, not timely or not necessary to be retained, it shall be promptly corrected or deleted;

(c) if the investigation does not resolve the dispute, the data subject may file a statement of not more than two hundred (200) words setting forth the data subject's position;

(d) whenever a statement of dispute is filed, the agency maintaining the data system shall supply any previous recipient with a copy of the statement and, in any subsequent dissemination or use of the information in question, clearly mark that it is disputed and supply the statement of the data subject along with the information;

(e) the agency maintaining the information system shall clearly and conspicuously disclose to the data subject the data subject's rights to make a request;

(f) following any correction or deletion of personal information the agency shall, at the request of the data subject, furnish to past recipients notification delivered to their last known address that the item has been deleted or corrected and shall require the recipients to acknowledge receipt of the notification and furnish the data subject the names and last known addresses of all past recipients of the uncorrected or undeleted information.

As added by Acts 1977, P.L.21, SEC.1. Amended by P.L.215-2016, SEC.5.