36. The person holding information that is the subject of a request for access or rectification must, if he does not grant the request, retain the information for such time as is necessary to allow the person concerned to exhaust the recourses provided by law.