Correcting inaccurate personal data
In brief – what does the Data Protection Act say about rights to correct or delete inaccurate information?
The fourth data protection principle requires personal data to be accurate. Where it is inaccurate, the individual concerned has a right to apply to the court for an order to rectify, block, erase or destroy the inaccurate information. In addition, where an individual has suffered damage in circumstances that would result in compensation being awarded and there is a substantial risk of another breach, then the court may make a similar order in respect of the personal data in question.
In more detail…
What if the inaccurate information was received from the individual concerned or from a third party?
It may be impractical to check the accuracy of personal data someone else provides. In recognition of this, the Act says that even if you are holding inaccurate personal data, you will not be considered to have breached the fourth data protection principle as long as:
- you have accurately recorded information provided by the individual concerned, or by another individual or organisation;
- you have taken reasonable steps in the circumstances to ensure the accuracy of the information (see the Keeping personal data accurate and up to date (Principle 4) and Retaining personal data (Principle 5) pages of the guide); and
- if the individual has challenged the accuracy of the information, this is clear to those accessing it.
In these circumstances the court may (as an alternative to ordering the rectification etc. of the inaccurate data) order that a statement of the true facts (in terms approved by the court) should be added to the record that contains it. And, if the court is not satisfied that you complied with the above requirements, it may order you to do so.
A couple who have a seriously ill baby object to the content of their child’s hospital records, saying they are inaccurate. Some of the information they object to came from the baby’s health visitor. Having tried without success to resolve the dispute informally, they go to court to ask for the records to be amended.
The court could order the hospital to rectify, block, erase, or destroy any inaccurate personal data. To the extent that the inaccurate data was provided by the health visitor, the court could (as an alternative) order that the data be supplemented by a statement of the true facts.
What about opinions based on inaccurate personal data?
This right also applies to personal data that contains an expression of opinion based on inaccurate personal data.
In the example above, the child’s parents claim that one of the reasons the hospital’s records are inaccurate is that they include a doctor’s opinion which is based on the inaccurate information provided by the health visitor. If it agrees, the court may order that the statement of opinion be rectified, blocked, erased or destroyed. Alternatively, it may order that the statement of opinion be supplemented by a statement recording that it was based on inaccurate information.
Should other people be told when inaccurate information is corrected or deleted?
If a court has ordered you to rectify, block, erase or destroy personal data, then it can also order you to notify any third parties to whom you have disclosed the information. The court would probably only require this if it is reasonable to expect that you would be able to comply with the order. As a matter of good practice, we would expect you to take reasonable steps to do this whether or not the court requires you to do so.
A bank is ordered to correct inaccurate information about an individual’s liability to repay a loan. The bank routinely provides information about such matters to the credit reference agencies. The court may order the bank to inform the credit reference agencies that the information has been corrected – and the bank should do so in any event.