I guess the Privacy Act has a couple of purposes to it, one of which is to certainly put in place rules respecting the use, collection, and disclosure of personal information by government institutions. The other thing it does is to create a right of access, if you will, by individuals to their personal information being held by government institutions.
So what would be happening under proposed section 22.1 is that in the first instance the Privacy Commissioner has an obligation to refuse to disclose any personal information, meaning again that the individual would be making a request for their information being held by the Privacy Commissioner. The Privacy Commissioner would be refusing to disclose any personal information they're holding with respect to that individual if that information was obtained or created by the commissioner in the course of an investigation.
Once the investigation is completed, then the personal information that was created by the Privacy Commissioner could be released to that individual, unless there are other parts of the Privacy Act that apply that would then restrict the ability of the Privacy Commissioner to provide that information to the individual to whom that information actually pertained.