Right to take action to rectify, block, erase or destroy inaccurate data
Correcting inaccurate personal data
The fourth data protection principle requires personal data to be accurate, and where necessary kept up to date.
The need to keep the personal data up to date depends on the nature of the personal data and the purpose it will be used for. Individuals only usually become aware of inaccurate information when they have made a subject access request, received a communication from the organisation, or something unexpected happens.
An individual is entitled to have any inaccuracies in their personal data put right. Data is “inaccurate” in data protection terms if it is “incorrect or misleading as to any matter of fact”.
An opinion, which does not purport to be a statement of fact, cannot, therefore, be challenged on the grounds of inaccuracy. Data cannot be inaccurate if it has been obtained from you in the first place, but the organisation should still take “reasonable steps” to ensure the accuracy of the information before further using or disclosing that information.
The organisation must also take “reasonable steps” to check the accuracy of any information obtained from a third party. In other words, the organisation should undertake appropriate checks to verify the information before it considers any use of it. When an organisation discloses information to a third party, irrespective of its source, it must take “reasonable steps” to ensure the accuracy of the information, taking into account the purpose for which it will be used by that third party, and the potential damage that may be caused to the individual if the information to be used by the third party is inaccurate.
An individual can exercise this right by writing to the organisation and asking it to correct any inaccuracies in the personal data. The organisation may comply with this request for example, by including a note of the individual's views alongside the information that has been identified as being inaccurate.
If the individual is dissatisfied with the response they can make a complaint to the Commissioner.
If the Commissioner considers that enforcement action is necessary, an enforcement notice can be issued requiring the inaccurate personal data to be rectified,erased, blocked or deleted.
There are several options available to the Commissioner.
In the case that the personal data is inaccurate and the Enforcement Notice requires that personal data to be rectified,erased, blocked or deleted, then the Commissioner may also require the data controller to rectify, block, erase or destroy any other data held by him and containing an expression of opinion which appears to the Commissioner to be based on the inaccurate data.
If personal data accurately record inaccurate information received or obtained by the data controller from the data subject or a third party, the Commissioner may issue an Enforcement Notice requiring the data controller to
- rectify, block, erase or destroy any inaccurate data and any other data held by him and containing an expression of opinion based on the inaccurate data, or
- take such steps as are specified in the notice for securing compliance with the requirements specified in paragraph 15 of Schedule 1 and, if the Commissioner thinks fit, for supplementing the data with such statement of the true facts relating to the matters dealt with by the data as the Commissioner may approve.
An Enforcement Notice requiring the rectification, blocking erasure or destruction of personal data, or if the Commissioner thinks that the information which has been rectified, blocked, erased or destroyed was also processed in contravention of any other principles, may also require the data controller to advise third parties to whom the data controller may have disclosed that personal data.
This right is also enforceable by a court order.