33 Protection of personal information The head of a public body shall protect personal information that is under his custody or control by taking reasonable steps to ensure that there is adequate security and there is no unauthorised access, collection, use, disclosure or disposal of such personal information. 34 Retention of personal information If a public body uses an individual’s personal information to make a decision that directly affects the individual, the public body shall retain that information for at least one year after using it so that the individual has a reasonable opportunity to have access to it. 35 Penalty for deliberately falsifying personal information A person who, if requested to do so, deliberately supplies a public body with false personal information shall be guilty of an offence and liable to a fine not exceeding twenty thousand dollars or imprisonment for a period not exceeding six months or to both such fine and such imprisonment. PART VI USE AND DISCLOSURE OF PERSONAL INFORMATION BY PUBLIC BODIES 36 Use of personal information A public body may only use personal information— (a) for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose; or (b) if the person to whom the information relates has identified the information and has consented, in the prescribed manner, to such use. 37 Disclosure for archival or historical purposes The National Archives, or the archives of a public body, may disclose personal information for archival or historical purposes if— (a) such disclosure would not result in an unreasonable invasion of a person’s personal privacy in terms of this Act; or (b) the information is about a person who has been deceased for thirty or more years. PART VII MEDIA AND INFORMATION COMMISSION 38 Establishment of Media and Information Commission (1) For the purposes of this Act, there is hereby established a Commission, to be known as the Media and Information Commission, which shall be a body corporate capable of suing and being sued in its own name and, subject to this Act, of performing all acts that bodies corporate may by law perform. 39 Functions and powers of Commission (1) Subject to this Act, the powers and functions of the Commission shall be— 20