A/HRC/14/46 past operations.129 States have also mandated independent oversight institutions to check whether the internal directives on file management comply with the law.130 States have acknowledged that oversight institutions need to be autonomous in their working and inspection methods, and have sufficient resources and capacities to conduct regular inspections of the management and use of personal data by intelligence services.131 Intelligence services have a legal duty to cooperate fully with the oversight institution responsible for scrutinizing their management and use of personal data.132 Practice 26. Individuals have the possibility to request access to their personal data held by intelligence services. Individuals may exercise this right by addressing a request to a relevant authority or through an independent data-protection or oversight institution. Individuals have the right to rectify inaccuracies in their personal data. Any exceptions to these general rules are prescribed by law and strictly limited, proportionate and necessary for the fulfilment of the mandate of the intelligence service. It is incumbent upon the intelligence service to justify, to an independent oversight institution, any decision not to release personal information. 40. Many States have given individuals the right to have access to their personal data held by intelligence services. This right may be exercised by addressing a request to the intelligence service,133 a relevant minister,134 or an independent oversight institution.135 The right of individuals to have access to their personal data files should be understood in the context of safeguards for privacy rights and the freedom of access to information. This safeguard is important not only because it allows individuals to check whether their personal data file is accurate and lawful, but also because it is a safeguard against abuse, mismanagement and corruption. Indeed, an individual’s right to have access to personal data held by intelligence services serves to enhance transparency and accountability of the decision-making processes of the intelligence services and, therefore, assists in developing citizens’ trust in Government actions.136 States may restrict access to personal data files, for reasons such as safeguarding ongoing investigations and protecting sources and methods of the intelligence services. However, it is good practice for such restrictions to be outlined in law, and that they meet the requirements of proportionality and necessity.137 129 130 131 132 133 134 135 136 137 GE.10-13410 In Norway, the Parliamentary Intelligence Oversight Commission is obliged to carry out six inspections per year of the Norwegian Police Security Service, involving at least 10 random checks in archives in each inspection and a review of all current surveillance cases at least twice per year; see Norway, Instructions for monitoring of intelligence, surveillance and security services, arts. 11.1 (c) and 11.2 (d). See Germany (footnote 2), sect. 14 (1), according to which the Federal Commissioner for Data Protection and Freedom of Information should be heard prior to issuing a directive on file management. Sweden, Ordinance containing Instructions for the Swedish Commission on Security and Integrity Protection, paras. 4–8 (on management and decision-making), 12 and 13 (on resources and support). Hungary (footnote 77), sect. 52. Croatia (footnote 2), art. 40 (1). Netherlands (footnote 20), art. 47. Sweden (footnote 27), art. 3; Switzerland (footnote 5), art. 18 (1). David Banisar, Public oversight and national security: Comparative approaches to freedom of information, Marina Caparini and Hans Born (eds.), Democratic control of intelligence services: Containing the rogue elephant, p. 217. Netherlands (footnote 20), arts. 53–56; Croatia (footnote 2), art. 40 (2) (3); Germany (footnote 2), sect. 15(2). 23