Division 10 Where personal information is used by the CBSA for purposes of making a decision affecting the interests of the data subject to whom it relates, it must be retained by the CBSA for a period of two years from the date of such use in order that the data subject may access the information upon which such a decision has been made, unless the individual consents to its earlier disposal or where a request for access to the information has been received, until such time as the individual has had the opportunity to exercise all his rights under the Privacy Act or the Access to Information Act.

In the case of information retained in the PAXIS database, this two-year requirement will be subsumed in the maximum 3.5 year period for which the information will be retained in that database.

In the case of information retained in an enforcement database, API and PNR information could be retained where necessary for a period of no more than six years for use by the CBSA for the investigative purposes described in section nine, and then a further maximum period of two additional years, during which time it would be available for access by the data subject in accordance with the Privacy Act or the Access to Information Act, but unavailable for administrative use by the CBSA.