What is the right to rectification?

What it is

Accuracy is a principle, and rectification is the person's way to enforce it. Data is inaccurate if it is incorrect or misleading as to any matter of fact. An opinion recorded accurately as an opinion is not inaccurate just because the person disagrees, but you may need to add their view.

When it applies

• The data is inaccurate. UK GDPR Art 16
• The data is incomplete for the purpose, including by adding a supplementary statement. Art 16

When you can refuse

• Manifestly unfounded or excessive requests. Art 12(5)
• Where an exemption applies. DPA 2018 Sch 2

Who is responsible

The controller.

What it involves

1. Check the data and the evidence.
2. Restrict processing while you verify, if asked.
3. Correct, complete or explain why not.
4. Tell recipients of the correction.
5. Respond within one month.

Timing

One month, extendable by two.

If it goes wrong

Regulatory

Failing to respond properly breaches Arts 12 to 22. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Most cases start with a complaint to the regulator, which can order compliance.

Criminal

No offence.

Civil

The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).