One of the rights ensured to European Union citizens under GDPR is their right to access personal data. In addition to having access to their personal data file, EU citizens also have a right to see any supplementary information attached to this data.
Article 16 of the GDPR outlines an individual’s right to correction. Basically it covers inaccurate personal data or incomplete personal data. Correction might involve attaching a supplementary statement to the personal data.
This right to correction and rectification means individual have the right to read the material in their personal file. They also have an opportunity to request that material in this file and the supplementary materials be correct, edited, removed, or modified if it is not accurate.
A request can be made orally or in writing.
Responsibilities of Data Collectors
The business or organization collecting the data has one month to respond to this request. A request may be refused but there must be a logical reason for this. Obligations are outlined in Article 5 (1) (d).
Businesses must have in place a process for responding to requests for correction. They must also have a process for rectifying, modifying, or correcting personal data.
When organizations receive a request for correction or rectification, they must take reasonable action to address this request. They must first look at whether the request has realistic and accurate evidence that changes should be made. The evidence should be checked to ensure that it does indeed need to be rectified.
Data is deemed inaccurate if the information contained in the personal data file is incomplete, incorrect, or even misleading.
What Action Should Be Taken?
Inaccuracies, omissions or mistakes need to be resolved. For instance if a file contains the wrong medical information, an updated, more accurate medical report needs to be added. If academic information is missing, this piece needs to be added.
If the data in question is an opinion, as long as this is noted as an opinion, it cannot be deemed inaccurate. It should be noted whose opinion it is. Article 18 stipulates how the information in question should be handled.
If the data collector is confident—upon checking—that the data is accurate, the individual who requested the correction will be informed that no change will be made. The request is noted for the file.
If the request is deemed unfounded, the data collector can refuse to comply. A fee can then be charged for the labor required to examine this request.