The right to request correction
The right to request correction covers the correction, supplementation, erasure and blocking of personal data. You may request correction where:
- your personal data are factually inaccurate;
- your personal data are incomplete or irrelevant to the purpose or purposes for which they have been collected;
- your personal data are being used in any other way that is contrary to the law.
Procedure for the submission of correction requests
When submitting a correction request, you must indicate which specific corrections you wish to be made. Correction requests must be submitted to a government body in writing or by e-mail. For all other companies or institutions (hereinafter: organisations), it is also recommended that requests be submitted in writing, since, in the event that the controller (i.e. the party using your personal data) refuses to correct your data and you wish to take your case to a court of law, you will be expected to indicate the steps already undertaken by you. Even where you request the mediation of the Dutch Data Protection Authority (Dutch DPA) [College bescherming persoonsgegevens (CBP)], the Dutch DPA will first ask you to submit copies of all correspondence. Please note that you can submit your request using the Dutch DPA’s model letter (in Dutch).
Compliance with correction requests
The controller must respond to your request within a period of four weeks. Should the controller refuse to make a correction, he must substantiate his refusal. If a refusal originates from a government body, you will be able to object to or appeal against the refusal. Where technical reasons prevent the correction of data, for example because the data in question are stored on a CD-ROM, the controller can create a file for data supplements and corrections. Where the controller agrees to correct the data, he must do this as soon as possible.
Where the controller complies with your request, the changes made must be passed on to other organisations to which the (incorrect) data in question were disclosed during the course of the previous year. The controller will not be required to notify the above organisations where:
- it would be impossible to trace these organisations, for example where the controller no longer has the information necessary to be able to do this; or
- this would require disproportionate effort on the part of the controller. By weighing up your interests against those of the organisation, the controller is able to determine whether or not disproportionate effort would be required.
Disproportionate effort would be involved in the correction of a name spelt incorrectly in a national telephone book. In this situation, it would not be reasonable to expect the publisher of the telephone book to notify everyone who has received the telephone book of the change made.
Scope of the right to request the correction of data
The right to request the correction of data is not intended for the correction of personal data consisting of professional impressions, opinions and conclusions that are relevant but with which you do not agree. However, it would be reasonable to expect the controller to add written comments to the file. In the event of disputes regarding the content of reports, for example, the Dutch DPA takes the position that the addition of your point of view may be an acceptable solution, particularly in cases where facts are not open to objectivation.
Conditions for correction
The following conditions apply to the correction of data:
- The controller must be able to establish that you are the person to whom the personal data in question relate. This is vital in order to prevent an individual’s amendment of your data using your name. Your identity can be established by means of a driving licence, passport or other identity document;
- You will only be able to submit a correction request if you are older than 16 and provided you have not been placed under guardianship. In all other cases, requests to access data must be made by your legal representative (a parent, for example) and the corresponding answer must be addressed to this representative. If uncertainty exists as to the status of a parent’s parental authority, an organisation may request proof of parental authority (or, in the case of someone other than your parents: guardianship). Parental authority can be demonstrated by producing a recent copy of your birth certificate, together with a recent extract from the custody register. This will identify the identity of your mother and whether you have been acknowledged (and if so, by whom). Where no entry can be found in the custody register, no change has occurred in the situation stated in the data subject’s birth certificate.
Correction of medical records
As a patient you are entitled to request the correction
of data in your medical records. Besides the Wbp, the
Wet op de Geneeskundige Behandelingsovereenkomst (Wgbo)
[Medical Treatment Contracts Act] also applies to medical
records. The Wgbo is laid down in Book 7 of the Burgerlijk
Wetboek (BW) [Civil Code]. Similar to the Wbp, the
Wgbo does not always provide for patients’ entitlement
to correct the impressions and opinions of practitioners
set out in your medical records. However, under the
Wgbo, you will be able to have written comments added
to your records in the event of a difference of opinion.
For more information on this subject see the fact sheet
Your Rights
as a Patient [Uw rechten als patiënt].
If you have questions or complaints
Your first course of action must always be to
approach the organisation itself with any questions or
complaints you may have. Where the organisation fails
to comply with your request for the correction of data,
you will be able to request that the Dutch DPA mediate.
For information, please s ee the fact sheet entitled
Mediation by the
Dutch DPA in Respect of Your Data [Bemiddeling door
het CBP inzake uw gegevens]. If you believe that your
personal data has been used wrongfully and the controller
fails to respond to your complaints, or fails to respond
to your satisfaction, please refer to the fact sheet
entitled Your
Complaint and the Dutch DPA [Uw klacht en het CBP] for information on the subsequent action open to you .
Your other rights
In addition to the right to request the correction of
data, you are also entitled to access your personal
data and lodge objections. For information on how to
exercise these rights, see the fact sheets entitled
Access to Your
Personal Data [Inzage in uw persoonsgegevens] and
The
Combating of Unsolicited Advertising [Het tegengaan
van ongevraagde reclame].