Accurate personal data is important, particularly where decisions are made about individuals based on that information. Article 16 sets out the right to rectification of inaccurate data and Recital 65 provides additional guidance.
The law also explicitly states that, having regard to the purpose for processing the personal data, data subjects have the right to obtain completion of incomplete personal data "including by means of providing a supplementary statement".
If the controller has disclosed inaccurate personal data, Article 19 applies and the controller must advise each recipient of the data in question about the rectification and, if requested, the controller must inform the data subject about those recipients.
Action to be taken by controllers
- carefully consider any challenges to the accuracy of personal data by a data subject;
- respond to the individual without undue delay and within one month to communicate the action, or inaction, taken;
- communicate the rectification to each recipient it has been disclosed to (Article 19);
- if the individual has requested to be informed about those recipients, communicate those details to to the individual (Article 19).
Refusing a request
Controllers may refuse to comply with all or part of the request for rectification but must be able to justify its decision.
Requests may be refused in cases where:
- the request is manifestly unfounded or excessive, in particular if it is repetitive (Article 12(5));
- a restriction on the right can be justified in the particular circumstances (Article 23)
Non-compliance with requests to exercise rights
If the controller is not taking action on the request of the individual to exercise any right, it must inform the individual “without delay” (and within ONE month of receipt of the request) about:
- the reasons for not taking action; and
- their remedies, in particular the right to lodge a complaint with a supervisory authority and to seek a judicial remedy.