S16 (6) The Commission may direct a data controller to publicise, in any manner specified, the fact of any compromise to the integrity or confidentiality of personal information, where the Commission has reasonable grounds to believe that the public would protect a data subject who may be affected by the compromise. Quality of information 18. (1) A person who is responsible for collecting and processing of personal information shall take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and kept up to date where necessary. (2) In taking the steps referred to in subsection (1), the party responsible for collecting and processing of personal information shall have regard to the purpose for which personal information is collected and processed. Access to and challenging of personal information 19. (1) A data subject who provides adequate proof of identity, shall have a right to request – (a) a data controller to confirm, free of charge, whether or not the data controller holds personal information about the data subject; and (b) from a data controller, personal information about the data subject held by the data controller, including information about the identity of all third parties who have or have had, access to the information – (i) within a prescribed time; (ii) at a prescribed fee; (iii) in a reasonable manner and format; and (iv) in a form that is generally understandable. (2) Where the data controller denies a data subject a request made in terms of subsection (1) the data subject shall be entitled to be given written reasons for the denial. (3) A data subject shall have a right to challenge the written reasons for denial or requests made in terms of subsection (1). (4) If, in accordance with subsection (1) (b), personal information is communicated to a data subject, the data subject shall be advised of the right in terms of this Act to challenge the correctness of the information. Correction of personal information 20. (1) A data subject shall, free of charge have a right to challenge the correctness of information by requesting that a data controller – (a) corrects or deletes personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or