What does “accuracy” mean under the GDPR?

There are seven basic data protection principles under EU data protection law. The fourth principle is the principle of “accuracy” (GDPR Article 5 (1) (d)).

Article 5 of GDPR

Personal data shall be:

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

[See also Article 16 of GDPR (right to rectification)]

EU data protection law requires that data be ‘accurate’, ‘kept up to date’ and ‘erased or rectified’ when inaccurate. GDPR does not define the word ‘accurate’ but, Based on the meaning of the word, it can be said that data is inaccurate when it is incorrect or misleading.

In practice, accuracy means that controllers and processors must:

• take reasonable steps to ensure the accuracy of any personal data;
• ensure that the source and status of personal data is clear;
• carefully consider any challenges to the accuracy of information; and
• consider whether it is necessary to periodically update the information.

Being clear about what a record intends to show and the uses for it is important to determine accuracy (for example, just because personal data changed doesn’t mean that a historical record is inaccurate as long as it is clear that it is a historical record).

Example: If an individual moves house from London to Manchester a record saying that they currently live in London will obviously be inaccurate. However a record saying that the individual once lived in London remains accurate, even though they no longer live there.

Example: The Postcode Address File (PAF) contains UK property postal addresses. It is structured to reflect the way the Royal Mail delivers post. So it is common for someone to have a postal address linked to a town in one county (eg Stoke-on-Trent in Staffordshire) even if they actually live in another county (eg Cheshire) and pay council tax to that council. The PAF file is not intended to accurately reflect county boundaries.

It can be appropriate to keep a record of mistakes and corrections provided that the record is not misleading about the facts. An entity may legitimately need records to accurately reflect the order of events and keeping track of mistakes and corrections might in fact be in the individual’s best interests.

Example A misdiagnosis of a medical condition continues to be held as part of a patient’s medical records even after the diagnosis is corrected, because it is relevant for the purpose of explaining treatment given to the patient, or for other health problems.

Example: An individual finds that, because of an error, their account with their existing energy supplier was closed and an account opened with a new supplier. Understandably aggrieved, she believes the original account should be reinstated and no record kept of the unauthorized transfer. Although this reaction is understandable, if her existing supplier did close the account and another supplier opened a new account, then records reflecting what actually happened will be accurate. In such cases it makes sense to ensure that the record clearly shows that an error occurred.

Example: An individual is dismissed for alleged misconduct. An Employment Tribunal finds that the dismissal was unfair and the individual is reinstated. The individual demands that the employer deletes all references to misconduct. However, the record of the dismissal is accurate. The Tribunal’s decision was that the employee should not have been dismissed on those grounds. The employer should ensure its records reflect this.

Records of opinion are not necessarily inaccurate just because the data subject disagrees with the opinion, or the opinion is later proved to be wrong. Opinions are, by their very nature, subjective and not intended to record matters of fact. However, in order to be accurate, the record must make it clear that it is an opinion, and, where appropriate, whose opinion it is. Also, if it becomes clear that an opinion was based on inaccurate data, this fact should be recorded to ensure the records are not misleading.

Example: An area of particular sensitivity is medical opinion, where doctors routinely record their opinions about possible diagnoses. It is often impossible to conclude with certainty, perhaps until time has passed or tests have been done, whether a patient is suffering from a particular condition. An initial diagnosis (which is an informed opinion) may prove to be incorrect after more extensive examination or further tests. However, if the patient’s records reflect the doctor’s diagnosis at the time, the records are not inaccurate, because they accurately reflect that doctor’s opinion at a particular time. Moreover, the record of the doctor’s initial diagnosis may help those treating the patient later, and in data protection terms is required in order to comply with the ‘adequacy’ element of the data minimization principle.

Information used for a purpose that relies on it remaining current should be kept up to date. Updating data is not always required, however. For example, if you hold personal data only for statistical, historical or other research reasons, updating the data might defeat that purpose.

Example: An individual places a one-off order with an organisation. The organisation will probably have good reason to retain a record of the order for a certain period for accounting reasons and because of possible complaints. However, this does not mean that it has to regularly check that the customer is still living at the same address.

On the other hand, if an individual informs the organization of a new address, it should update its records. And if a mailing is returned with the message ‘not at this address’ marked on the envelope — or any other information comes to light which suggests the address is no longer accurate — the organization should update its records to indicate that the address is no longer current.

Organizations must take ‘reasonable steps’ to make sure the information is correct especially where the information could have serious implications for the individual. What is a ‘reasonable step’ will depend on the circumstances and, in particular, the nature of the personal data and what it will be used for. This may include getting independent confirmation that the data is accurate from third parties.

Example: An organisation recruiting a driver will want proof that the individuals it interviews are entitled to drive the type of vehicle involved. The fact that an applicant states in his work history that he worked as a Father Christmas in a department store 20 years ago does not need to be checked for this particular job.

When the records are based on information provided by someone else, organizations must:

• accurately record the information provided;
• accurately record the source of the information;
• take reasonable steps in the circumstances to ensure the accuracy of the information; and
• carefully consider any challenges to the accuracy of the information.

ICO Checklist

The Information Commissioner’s Office website includes a helpful Checklist that summarizes this principle:

Consequences of non-compliance

Failure to comply with data protection principles may lead to substantial fines. Article 83(5)(a) of GDPR states that infringements of the basic principles for processing personal data are subject to the highest tier of administrative fines. This could mean a fine of up to €20 million, or 4% of your total worldwide annual turnover, whichever is higher.

NOTES:

Further reading includes Articles 16 (the right to rectification) and 17 (the right to erasure).

Additional Resources

Recitals - (39) Principles of Data Processing (74) Responsibility and Liability of the Controller

GPEN 2018 Accountability Report