A credit reporting body or a reporting entity in possession or control of personal information, or other information of a kind referred to in subsection 35E(1), that relates to a verification request or an assessment in relation to an individual must take reasonable steps to ensure that the individual can obtain access to the information.