Article 16 of the General Data Protection Regulation (GDPR) provides for the rectification of personal data where the personal data that is being processed is inaccurate, or taking into account the purposes of processing, the data is incomplete in some way.

Under either circumstance, the suggestion from this office is to first contact the data controller directly outlining what personal data you feel is inaccurate or incomplete. It is important to note that the personal data must be “factually inaccurate”, this means that the data controller has recorded information such as a date of birth or address incorrectly and this is easily proven to be wrong and can be easily corrected.

However, where the personal data relates to the opinions of a third party about you and you disagree with those opinions, that is not so easily proven to be inaccurate as it is an opinion and not a matter of fact. The data subject can still make a rectification request to reflect what in their opinion is the correct position, however, the data controller is under no obligation to change it.

Likewise, the data controller is not obliged to erase it as the information may be required to set out the details of an incident, for example, witness statements from a car crash or witness statements to an alleged incident of bullying. The data controller can add the data subject’s statement outlining why they disagree with the opinion to the record and this can ensure that all parties have been heard and completes the record for all parties.