160 / 192
“correct” this decision. It is something the Appellant has to settle with that organisation himself.
11.33
Often the data subjects and the data users may have contradictory views on the
correctness of opinion data. For instance, a patient may disagree with a doctor’s
diagnosis of mental illness. Pursuant to section 24(3), a data user may refuse to comply
with a data correction request if the data user is not satisfied that the personal data to
which the request relates is inaccurate. In respect of medical opinion, for instance, the
Commissioner would not be in a position to comment on the accuracy or otherwise of
an opinion made by a medical professional. In AAB No. 42/2006, the AAB stated in its
decision:
. . . [the AAB] is not in a position to find any error in the Commissioner’s view that he would not
be in a position to determine whether the opinions concerning the mental condition of the
Appellant contained in the Forms were accurate or not. That is clearly something beyond the
scope of the Commissioner’s duty.
Steps To Take in Refusing to Comply with a Data Correction Request
11.34
Usually, where a data user refuses to comply with a data correction request, two basic
steps should be taken: first, to put a relevant entry in its log book as required under
section 27(2)(c) and (3)(c), and secondly, to notify the requestor in accordance with
section 25(1).
11.35
In this connection, section 27(2)(c) and (3)(c) provide as follows:
(2) A data user shall in accordance with subsection (3) enter in the log book –
. . .
(c) where pursuant to section 24 the data user refuses to comply with section 23(1) in
relation to a data correction request, particulars of the reasons for the refusal;
. . .
(3) The particulars required by subsection (2) to be entered by a data user in the log book
shall be so entered –
. . .
(c) in the case of particulars referred to in paragraph (c) of that subsection, on or
before the notice under section 25(1) is served in respect of the refusal to which
those particulars relate; . . .
11.36
Section 25(1)(a) provides as follows:
(1) A data user who pursuant to section 24 refuses to comply with section 23(1) in relation
to a data correction request shall, as soon as practicable but, in any case, not later
than 40 days after receiving the request, by notice in writing inform the requestor –
(a) of the refusal and the reasons for the refusal . . .”