13. Rectification of inaccuracies, etc. 

13.—

1. An individual may in writing to a data controller request that the data controller rectify any inaccuracy in any personal data—

(a) in the possession or control of the data controller; and

(b) of which the individual is the data subject.

2. For the purposes of subsection (1)— “inaccuracy” includes any error or omission; “rectify” means amend, block, erase or destroy, as may be required to correct the inaccuracy.

3. Where a data controller receives a request under subsection (1), the data controller shall, within thirty days after receiving the request, determine whether a rectification is required and—

(a) if no rectification is required, include with the personal data concerned an annotation of the correction that was requested, and notify the individual making the request that no rectification was made; or

(b) if a rectification is required, make the rectification and give notice of the rectification to—

(i) the individual making the request; and

(ii) so far as is reasonably practicable, every person, or other entity, to whom the personal data was disclosed at any time during the period of twelve months immediately before the date of the request.

4. Upon receiving a notification under subsection (3)(b), the person, or other entity, to whom the personal data was disclosed during the period mentioned in that provision shall make a corresponding rectification of such of the personal data concerned as is in that person or entity’s possession or control.

5. A data subject may appeal in writing to the Commissioner against any determination made by a data controller under subsection (3) and if the Commissioner is satisfied—

(a) as to the actions taken by the data controller under this section, the Commissioner shall dismiss the appeal; or

(b) that the data controller erred in making a determination that no rectification is required, or erred in the type of rectification required to be effected, the Commissioner shall order such rectification of the personal data as the Commissioner considers appropriate, and the data controller shall comply with the order.

6. Where an appeal is made to the Commissioner under this section, the Commissioner may appoint a duly qualified mediator to enquire into the matter and make such recommendations to the Commissioner for the resolution of the matter as the mediator considers appropriate, and the Commissioner may act on those recommendations.