The Right to Rectification: GDPR Rights Explained

The right to rectification, as outlined in Article 16 of the General Data Protection Regulation (GDPR), grants individuals the authority to request the correction of inaccurate personal data concerning them. This fundamental right empowers individuals to ensure the accuracy and integrity of their personal information held by data controllers.

Contents

• What Does the GDPR Say?

• Understanding the Scope of the Right to Rectification

• Key Components of the Right to Rectification

• Limits to the Right to Rectification

• How to Comply

• If You Refuse the Request

• Conclusion

What Does the GDPR Say?

Article 16 of the GDPR reads “The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”

Understanding the Scope of the Right to Rectification

The right to rectification applies when personal data held by a data controller is inaccurate, incomplete, or outdated. Individuals have the right to request the rectification of such data to ensure its accuracy and relevance. Data controllers also have to tell any data processors they have shared the relevant data with about any changes they make to that personal data.

The right to rectification is not absolute. This is partly because what is or is not accurate can sometimes be subjective. Where people feel their data are incomplete the right to have it completed depends in part on the purposes of the data processing.

Case Study

We worked with a hospital trust to deliver improved GDPR compliance. In this example a patient asked for their information to be updated because their employment was incorrect. They also disagreed with a medical opinion expressed by a clinician in their records.

We were happy to correct the data relating to employment, but we did not change the medical opinion. This is because although the patient disagreed with the opinion, this did not make it inaccurate. So long as the medical records accurately recorded the opinion, it was not inaccurate. However, in line with good practice, we did record the patient’s disagreement with the opinion.

The patient also asked us to take reasonable steps to update anyone the hospital had shared the incorrect information with.

Key Components of the Right to Rectification

• Request for Correction: individuals have the right to submit a request to the data controller for the rectification of inaccurate or incomplete personal data. The request does not have to be in writing. People do not have to quote the GDPR or make reference to the right to rectification. If you receive a request you should ensure you record it. You may also need to confirm the requestor’s identity.

• Timely Response: Data controllers must respond to rectification requests promptly and without undue delay. The GDPR stipulates that controllers should rectify inaccurate data within one month of receiving the request. However you can extend this period in complex cases, but up to a further two months.

• Verification Process: Data controllers are responsible for verifying the accuracy of the data in question before making any rectifications. This may involve conducting internal assessments or requesting additional information from the data subject to validate the requested changes.

• Communication of Rectification: Upon rectifying inaccurate data, data controllers must inform the data subject of the corrections made. This ensures transparency and allows individuals to verify that their personal information has been updated as requested.

Limits to the Right to Rectification

While the right to rectification empowers individuals to correct inaccurate personal data, certain limitations and exceptions apply:

• Disputed Accuracy: If the accuracy of the data is disputed by the data subject, the data controller may restrict processing of the disputed data until its accuracy can be verified. In such cases, the controller must indicate the disputed status of the data.

• Excessive or Unfounded Requests: Data controllers may refuse to act on rectification requests that are excessive, unfounded, or repetitive. However, they must inform the data subject of the reasons for refusal and their right to lodge a complaint with the supervisory authority.

• Incompatibility with Legal Obligations: Rectification requests may be denied if fulfilling them would contravene legal obligations or compromise the legitimate interests of the data controller or other parties.

• Third-Party Data: The right to rectification does not extend to personal data obtained from third parties unless the data subject can demonstrate inaccuracies directly related to them. Similarly people are not generally allowed to have data about other people corrected.

How to Comply

Compliance with the right to rectification is quite simple. All you need to do is:

• make the necessary changes to your records;

• inform any relevant data processors so they can make the same changes;

• confirm to the data subject that this has been done;

• do all of this within one month of receiving the request.

If You Refuse the Request

If you refuse a request for rectification, you must tell the individual, informing them of their right to raise a complaint with the Information Commissioner.

Conclusion

The right to rectification under the GDPR empowers individuals to maintain the accuracy and integrity of their personal data held by data controllers. While this right grants individuals greater control over their information, it is subject to certain limitations and exceptions to ensure a balance between data subject rights and the legitimate interests of data controllers. By understanding the scope and limitations of the right to rectification, both data subjects and controllers can navigate data protection obligations effectively and uphold the principles of accuracy and transparency outlined in the GDPR.