In the first part of this blog series, we explained your right to erasure, restriction, and objection under GDPR. But what happens when this information is wrong? The General Data Protection Regulation (GDPR) provides a solution with the “right to rectification,” empowering you to ensure the accuracy and completeness of your data.
Understanding the Scope of Rectification
The right to rectification, enshrined in Article 16 of the UK GDPR, grants individuals the power to demand the correction of inaccurate or incomplete personal data without undue delay. While typos and outdated information are common examples, the right to rectification extends far beyond these simple errors. It also covers situations where the data held about you is misleading or gives a false impression. For instance, if your purchase history with an online retailer is inaccurate, leading to targeted advertising that does not align with your interests, you can invoke your right to rectification to have this corrected. The right to rectification covers a range of information:
- Identifying information: Your name, address, contact details, online identifiers, etc.
- Descriptive data: Age, gender, nationality, occupation, etc.
- Financial information: Bank account details, credit card information, etc.
- Health data: Medical records, diagnoses, treatments, etc.
- Online activity: Browsing history, purchase history, social media activity, etc.
Any information that identifies or can be used to identify you falls under the scope of the right to rectification.
The Importance of Accurate Data
Why is having accurate data so important? Inaccurate data can lead to a number of negative consequences, such as:
- Denied services: Incorrect address details might prevent you from receiving deliveries or accessing services.
- Missed opportunities: Outdated contact information could lead to missed job offers or important communications.
- Discrimination: Inaccurate data used for profiling or automated decision-making could result in unfair treatment.
- Identity theft: Incorrect information can make you more vulnerable to fraud and identity theft.
By ensuring your data is accurate and up to date, you can minimise these risks and maintain control over your personal information.
Exercising Your Right to Rectification
The process is designed to be straightforward. You can contact the organisation holding your data (the data controller) through various channels, such as email, letter, or their website’s contact form. Clearly state your request, specifying the inaccuracies and providing supporting evidence if necessary. While the process is generally free, a reasonable fee may be charged in cases of excessive or unfounded requests.
· Online forms: Many organisations provide online forms as part of their privacy policies specifically for data rectification requests.
- Email: You can send an email to the data controller’s designated contact address, which should be available on their online privacy policy.
- Postal mail: Formal written requests can be sent via postal mail to the organisation’s registered address, again this should be available via their privacy policy.
In your request, clearly specify the inaccurate or incomplete data and provide the correct information. The data controller is obligated to respond to your request without undue delay, and in any case, within one month, although they can request additional information to verify your identity.
Beyond Simple Corrections
Determining what constitutes “inaccurate” data can sometimes be subjective. Consider a case where a business holds data about your “customer satisfaction rating.” If this rating is based on a flawed survey or outdated feedback, you could argue it is inaccurate and request a reassessment.
While correcting typos and updating outdated information might seem simple, the right to rectification also covers more complex scenarios:
- Contested information: If you dispute the accuracy of certain information, the data controller might be required to mark the data as contested while they investigate.
- Incomplete data: You can request that missing information be added to your data record, providing supporting evidence if necessary.
- Data portability: In conjunction with the right to data portability, you can request that your corrected data be transferred to another organisation.
Safeguarding Your Data Rights
The right to rectification is a powerful tool for individuals at a time when the use of electronic data is rapidly increasing. It allows you to take control of your personal information and ensure it is accurate and complete. By understanding and exercising this right, you can safeguard yourself against the potential harm caused by inaccurate or outdated data. Remember, you have the right to be accurately represented in the digital world, and GDPR provides the framework to make that right a reality.
As we mentioned in the first part of this blog – Your right to Erasure – the ICO (Information Commissioner’s Office) has a wide range of resources and advice where you can find more information about your rights as an individual which we recommend you visit. If you are an organisation or business who needs help managing rectification or other data subject access requests, please get in touch.