Data Protection Act 1988
Right of rectification or erasure.
6.—(1) An individual shall, if he so requests in writing a data controller who keeps personal data relating to him, be entitled to have rectified or, where appropriate, F24[blocked or] erased any such data in relation to which there has been a contravention by the data controller of section 2 (1) of this Act; and the data controller shall comply with the request as soon as may be and in any event not more than 40 days after it has been given or sent to him:
Provided that the data controller shall, as respects data that are inaccurate or not kept up to date, be deemed—
(a) to have complied with the request if he supplements the data with a statement (to the terms of which the individual has assented) relating to the matters dealt with by the data, and
(b) if he supplements the data as aforesaid, not to be in contravention of paragraph (b) of the said section 2 (1).
F25[(2) Where a data controller complies, or is deemed to have complied, with a request under subsection (1) of this section, he or she shall, as soon as may be and in any event not more than 40 days after the request has been given or sent to him or her, notify—
(a) the individual making the request, and
(b) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period of 12 months immediately before the giving or sending of the request unless such notification proves impossible or involves a disproportionate effort,]
Inserted (1.07.2003) by Data Protection (Amendment) Act 2003 (6/2003), s. 7(a), S.I. No. 207 of 2003.
Substituted (1.07.2003) by Data Protection (Amendment) Act 2003 (6/2003), s. 7(b), S.I. No. 207 of 2003; subs. (2)(b) commenced (18.07.2014) by S.I. No. 338 of 2014.
Modifications (not altering text):
Application of section extended with modification (27.01.2014) by Credit Reporting Act 2013 (45/2013), s. 19(2), (4), S.I. No. 19 of 2014.
(2) Sections 2, 4 and 6 of the Data Protection Act 1988 shall have effect as if—
(a) references to personal data included relevant credit data, and
(b) a person to whom this section applies were a living individual, and sections 9, 10, 12 and 24 to 31 of that Act apply accordingly.
(4) This section applies to any person with an annual turnover of not more than €3,000,000 (and to whom sections 2, 4 and 6 of the Data Protection Act 1988 would not apply apart from this section).