Yes, I have a question regarding recommendation 16 on limiting exemptions to personal information access requests. It says the exemption should be injury-based and discretionary. Injury-based is simple to contemplate, but how would discretionary be applied in terms of limiting exemptions?
