Your Right Under Data Protection Laws: Understanding the Right to Rectification

Introduction

The hallmark of today’s digital age is the unprecedented rise in the processing of personal data. From  Artificial Intelligence (AI) tools to social media platforms to online shopping websites, we are constantly sharing our personal information with various companies and organizations, in other to access services conveniently. While this may provide us with convenience, it may pose some threat to our privacy.

To address this issue, data protection laws/regulations such as the General Data Protection Regulation (GDPR) and the Nigerian Data Protection Regulation (NDPR) were introduced to — among other things, provide individuals with a number of rights when it comes to their personal data. This blog post will focus on one of these rights — the right to rectify personal data.

The Right to Rectify

To rectify means to make a correction. The right to rectify personal data under data protection laws allows individuals to request that any inaccurate or incomplete personal data that an organization holds about them be corrected. Art. 16 of the GDPR states, “The data subject shall have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.” This is also the position of Reg. 3.1 (7)(h) of the  NDPR. 

In other words, if an organization has your name spelled incorrectly, or has an outdated address or phone number, or where a person seeks to correct information wrongly stated in their National Identity card or Biometric Verification Number (BVN), you have the right to request that this information be corrected or updated.

The Scope of Right to Rectify Vis-a-Vis the Concept of Accuracy

This right to rectify has a link to the principle of accuracy. This principle simply states that the data controller must process personal data accurately. That is, the information they process must be correct. We shall discuss the principle of accuracy properly in future blog posts. 

Interestingly, the GDPR and even NDPR do not give a definition for the term ‘accuracy’. The challenge will be, determining whether personal data is inaccurate if the personal data refers to a mistake that has subsequently been resolved. A valid argument will be that the record of the mistake is, in itself, accurate and should be kept. In such circumstances, the fact that a mistake was made and the correction imputed is ‘accurate’ data. For example, when a patient is diagnosed by a GP as suffering from a particular illness or condition, but it is later proved that this is not the case, it is likely that their medical records should record both the initial diagnosis (even though it was later proved to be incorrect) and the final findings. Whilst the medical record shows a misdiagnosis, it is an accurate record of the patient’s medical treatment. As long as the medical record contains up-to-date findings, and this is made clear in the record, it would be difficult to argue that the record is inaccurate and should be rectified.

How to Exercise Your Right to Rectification

To exercise your right to rectify personal data, the first point of call is to contact the organization that holds your data and request access to your personal data which they process. Once you have access, and notice inaccurate data, provide them with the correct information. Under the GDPR and NDPR, organizations are required to respond to your request within a timeframe of one month and must either correct the data or provide an explanation of why they are unable to do so.

Also, there is no specified form (whether in writing or verbally) the request for rectification can be made in any form and to any part of the organization including the employee. It needs not possess the phrase “request for rectification” or the relevant articles of the regulation to be a valid request. It will suffice once the content challenges the accuracy of the personal data in the issue. Where data was disclosed to a third party, steps must be taken to inform them about the rectification provided such steps will not amount to disproportionate effort.

It is important to note that the right to rectify personal data is just one of several rights that individuals have under the law. Other rights include the right to access personal data, the right to erasure, the right to restrict processing, the right to data portability, etc.

Conclusion 

Overall, the right to rectify personal data is an important tool that individuals can use to protect their privacy and ensure that their personal information is accurate and up-to-date. By exercising this right, you can help to ensure that organizations are held accountable for their data processing practices and that your personal data is being handled in accordance with the law.