The right to request correction
The right to request correction covers the correction, supplementation, erasure and blocking of personal data. A data subject may request correction where:
- his personal data are factually inaccurate;
- his personal data are incomplete or irrelevant to the purpose or purposes for which you have collected them;
- you are using the data subject’s personal data in any other way that is contrary to the law.
Procedure for the submission of correction requests
When submitting a correction request, data subjects must indicate which specific corrections they wish to be made. Correction requests must be submitted to a government body in writing or by e-mail. For all other companies or institutions (hereinafter: organisations), it is also recommended that requests be submitted in writing.
Compliance with correction requests
You must respond to requests submitted by data subjects within a period of four weeks. Should you refuse to make a correction, you must motivate your refusal. If you are a government body, you must inform data subjects of their right to object to or appeal against your refusal. Where technical reasons prevent the correction of data, for example because the data in question are stored on a CD-ROM, you can create a file for data supplements and corrections. Where you agree to correct the data, you must do this as soon as possible.
Where you comply with a request, the changes made must be passed on to other organisations to which the (incorrect) data in question were disclosed during the course of the previous year. You will not be required to notify the above organisations where:
- it would be impossible to trace these organisations, for example where you no longer have the information necessary to be able to do this; or
- this would require disproportionate effort on your part. You can determine whether or not this would be the case by weighing up your interests against those of the data subject. Disproportionate effort would be involved in the correction of a name spelt incorrectly in a national telephone book. In this situation, it would not be reasonable to expect the publisher of the telephone book to notify everyone who has received the telephone book of the change made.
The scope of correction
The right to request correction is not intended for the correction of personal data consisting of professional impressions, opinions and conclusions that are relevant but with which the data subject does not agree. However, it would be reasonable to expect you to add written comments to the file. In the event of disputes regarding the content of reports, for example, the Dutch Data Protection Authority (Dutch DPA) [College bescherming persoonsgegevens (CBP)] takes the position that the addition of the data subject’s point of view may be an acceptable solution, particularly in cases where facts are not objectifiable.
Conditions for correction
The following conditions apply to the correction of data:
- You must be able to establish that the data subject is the person to whom the personal data in question relates. This is vital in order to prevent an individual’s amendment of someone else’s data using their name. An individual’s identity can be established by means of a driving licence, passport or other identity document.
- A data subject will only be able to submit a correction request if he is older than 16 and provided he has not been placed under guardianship. In all other cases, requests to access data must be made by the data subject’s legal representative (a parent, for example) and the corresponding answer must be addressed to this representative. If you are uncertain about the status of a parent’s parental authority, you must establish whether or not the parent in question is the legal representative of the minor concerned. In these situations, the production of an identity document will be insufficient. Parental authority (or, in the case of someone other than the data subject’s parents: the guardian) can be demonstrated by producing a recent copy of the data subject’s birth certificate, together with a recent extract from the custody register. This will identify the data subject’s mother and whether the child has been acknowledged (and if so, by whom). Where no entry can be found in the custody register, no change has occurred in the situation stated in the data subject’s birth certificate.
Correction of medical records
A patient can request the correction of data in his medical records. Besides the Wbp, the Wet op de Geneeskundige Behandelingsovereenkomst (WGBO) [Medical Treatment Contracts Act] also applies to medical records. The WGBO is laid down in Book 7 of the Burgerlijk Wetboek (BW) [Civil Code]. Similar to the Wbp, the WGBO does not always provide for patients’ entitlement
to correct the impressions and opinions of practitioners
set out in their medical records. However, under the
WGBO, patients are able to have written comments added
to their records in the event of a difference of opinion.
More information on this subject can be found
in the fact sheet entitled Rechten
van uw patiënt [Your
patients and their rights].
If the data subject has questions or complaints
The data subject’s first course of action must always be to approach you with any questions or complaints he may have. Where you are unable to resolve these together, the data subject will be able to submit his questions or complaints to the Dutch DPA. See the fact sheet entitled Mediation by the Dutch DPA in Respect of Your Data Processing [Bemiddeling door het CBP inzake uw gegevensverwerkingen] for information on the mediation provided by the Dutch DPA . For information on the handling of complaints by the Dutch DPA , see the fact sheet entitled Dutch DPA Complaints Handling [Klachtenbehandeling door het CBP] .
Other rights available to data subjects
In addition to the right to request the correction of
data, data subjects are also entitled to access their
personal data and lodge objections. For information
on how to exercise these rights, see the fact sheets
entitled Het geven van inzage in persoonsgegevens [Allowing
Data Subjects Access to Personal Data] and The
Use of Customer Data for Direct Marketing Purposes [Het
gebruik van klantgegevens bij direct marketing].