56. Right of rectification, etc., of inaccurate personal data
-
(1) Where personal data processed by a data controller to which access has been given under any enactment, contains personal data of a data subject which the data subject claims—
-
(a) is incomplete, incorrect, misleading, or excessive;
-
(b) not relevant to the purpose for which the data is held,
the data controller shall, on application of the data subject, cause such data to be rectified, blocked, erased, destroyed or annotated as appropriate.
-
(2) Where a data controller has permitted a third party to have access to personal data referred to in subsection (1), he or she shall, as soon as reasonably practicable, request the third party to rectify, block, erase, destroy or annotate the data, as appropriate.
-
(3) Where a data controller or a third party fails to rectify, block, erase or destroy personal data referred to in subsection (1)(a) and (b), a data subject may apply to the Commissioner to have such data rectified, blocked, erased, destroyed, rendered inaccessible or annotated as appropriate.
-
(4) On being satisfied by an application under subsection (3) that the personal data is the data referred to in subsection (1)(a) and (b), the Commissioner shall direct the data controller to rectify, block, erase, destroy render inaccessible or annotate the data and any other personal data in respect of which he or she is the data controller.
-
(5) The Commissioner may direct the data controller to notify third parties to whom data has been disclosed, of any rectification, blocking, erasure, destruction or annotation of the data, if the Commissioner —
-
(a) issues a direction under subsection (4); or
-
(b) is satisfied on the application by an individual that personal data of which the individual is the data subject were inaccurate and have been rectified, blocked, erased, destroyed or annotated.
-
(6) The data controller shall comply with a direction issued under this section within fourteen days of receipt of the direction.