Perhaps I may respond to that. The law provides that you can only collect information that you need to collect for a stated purpose and only keep it as long as you need to keep it for that purpose, and then you must get rid of it. And you may say, well, then how do you police that?
The employee is in a position to go to the Privacy Commissioner and make a complaint that they believe there is information on the file that should not be there, and the Privacy Commissioner could investigate that complaint and demand—