Section 39: Rectification, erasure or restriction of processing
as enacted (not consolidated). juris shows this Act from a copy that is not the official consolidation, so it may not carry every amendment; the amendments juris holds are listed. It does not confirm that this is the law in force today.
39. Rectification, erasure or restriction of processing
(1) (a) A controller shall, on being informed of the inaccuracy
of personal data by a data subject to whom such data pertains, cause the
data to be rectified without undue delay.
(b) A right to rectification under paragraph (a) shall include
the right of a data subject to have incomplete personal data completed,
having regard to the purpose of the processing.
(2) A controller shall erase personal data without undue delay
where –
(a) the data are no longer necessary in relation to the
purpose for which they were collected or otherwise
processed;
504 Acts 2017 Acts 2017 505
(b) the data subject withdraws consent on which the
processing is based and where there is no other legal
ground for the processing;
(c) the data subject objects to the processing of personal
data and there are no overriding legitimate grounds for
the processing; or
(d) the personal data have been unlawfully processed.
(3) Where the controller has made the personal data public, he
shall take all reasonable steps to inform third parties processing such data,
that the data subject has requested the erasure of any links to, or copy or
replication of, that personal data.
(4) Subsections (2) and (3) shall not apply where the processing
of the personal data is necessary –
(a) for reasons of public interest in the field of public
health;
(b) for the purpose of historical, statistical or scientific
research;
(c) for compliance with a legal obligation to process the
personal data to which the controller is subject or for
the performance of a task carried out in the public
interest or in the exercise of official authority vested in
the controller; or
(d) for the establishment, exercise or defence of a legal
claim.
(5) A controller may, at the request of a data subject, restrict the
processing of personal data where –
(a) the accuracy of the personal data is contested by the
data subject, for a period enabling the controller to
verify the accuracy of the data;
(b) the controller no longer needs the personal data for the
purpose of the processing, but the data subject requires
them for the establishment, exercise or defence of a
legal claim;
506 Acts 2017 Acts 2017 507
(c) the processing is unlawful and the data subject opposes
the erasure of the personal data and requests the
restriction of their use instead; or
(d) the data subject has objected to the processing pursuant
to section 41 pending verification as to whether the
legitimate grounds of the controller override those of
the data subject.
(6) Where processing of personal data is restricted under
subsection (4) –
(a) the personal data shall, with the exception of storage,
only be processed with the data subject’s consent or for
the establishment, exercise or defence of a legal claim,
the protection of the rights of another person or for
reasons of public interest; and
(b) the controller shall inform the data subject before lifting
the restriction on processing of the personal data.
(7) The controller shall implement mechanisms to ensure that
the time limits established for the rectification, erasure or restriction of
processing of personal data, or for a periodic review of the need for the
storage of the personal data, are observed.