Inaccurate Personal Data – Understanding your Rights

Our world is data driven and the processing of personal data forms an essential part of our daily lives. Individuals may provide their personal data in a number of scenarios, for example, when ordering products online, or from an employee to an employer for retention in a business’s human resources records or when an individual applies for financial services products such as a mortgage or a personal loan.

The list of scenarios is of course very broad and is constantly growing.

However, what happens when the personal data that a business or service provider processes is inaccurate? Personal data may have a minor error in it which leads to some inconvenience to the individual but in other situations the inaccurate personal data may lead to significant harm to an individual.

The following is a list of scenarios that are affected by inaccurate personal data:

• An individual inputs his/her personal data into a bank’s website for a credit card application. The application process involves providing personal data and sensitive financial information via the bank’s website, the bank processes the personal data and uses a third party to check the individual’s credit score, the individual is refused the credit card due to an inaccuracy in his/her credit history.
• An individual’s contact details are recorded incorrectly in a company’s marketing database with marketing communications being regularly delivered to the customer’s neighbour. This is causing irritation to the neighbour.
• An individual provides his home address and contact details to his employer. The personal data is recorded inaccurately in a human resources software system. Sensitive documentation is sent in error by the employer to the wrong address.  
• An individual provides his/her medical information to a private health care provider, the health care provider fails to record key medical information about the individual in their systems.

In any of the above scenarios, an individual will suffer harm and is able to seek redress under UK GDPR to rectify erroneous personal data.

The right to rectification of personal data under UK GDPR

Under Article 16 of the UK GDPR, an individual can require an organisation, without undue delay, to rectify personal data where the personal data on that person is inaccurate. This includes a right to require an organisation to complete personal data that is incomplete, by providing a supplementary statement. 

The right to erasure of personal data under UK GDPR

Whilst the right to erasure is not an absolute right, it can be a useful tool in seeking redress by the data subject. Under Article 17 of the UK GDPR, an individual can require that an organisation, without undue delay, erases personal data where the personal data on that individual is no longer necessary for the purpose which it was originally collected or processed. 

Requirement to maintain accuracy of personal data

The rights to rectification and erasure do compliment one another. The obligation to rectify or erase personal data is related to the overarching principle under Article 5 of the UK GDPR, that organisations need to take reasonable steps to ensure that personal data is up to date and that personal data that is inaccurate is erased or rectified without undue delay. 

Timeframe for compliance

An organisation must comply with the request for rectification or erasure without undue delay and at the latest time within one month of receipt of the request to rectify or erase.

Individuals seeking to enforce their rights with respect to rectification or erasure will need to provide evidence of the erroneous personal data when giving notice to a data controller of a request to erase or rectify.  In any response from the data controller, individuals will require proof of erasure or rectification. The right to rectification of personal data is an important right for individuals under UK GDPR. 

WDPS has helped clients to enforce their rights to rectify erroneous personal data so as to ensure that their personal data is accurate.