161 / 192
11.37
The requirements to enter into a log book the refusal to comply with a data correction
request, and to give notification of such refusal to the requestor, are similar to the
requirements of a data access request. Regarding the requirement for a data user to
keep a log book under section 27(1), readers may refer to the discussion in paragraphs
10.90 to 10.92 in Chapter 10. A data user is required to keep a log entry containing the
particulars of the reasons for the refusal of the data correction request for four years.
11.38
Finally, where the data correction request relates to data that constitutes an “expression
of opinion”, the data user is required to take steps as required under section 25(2) and (3)
as follows:
(2) Without prejudice to the generality of subsection (1), where –
(a) the personal data to which a data correction request relates is an expression of
opinion, and
(b) the data user concerned is not satisfied that the opinion is inaccurate, then the
data user shall –
(i) make a note, whether annexed to that data or elsewhere –
(a) of the matters in respect of which the opinion is considered by the
requestor to be inaccurate; and
(b) in such a way that that data cannot be used by a person (including the
data user and a third party) without the note being drawn to the attention
of, and being available for inspection by, that person; and
(ii) attach a copy of the note to the notice referred to in subsection (1) which
relates to that request.
(3) In this section, “expression of opinion” includes an assertion of fact which -
(a) is unverifiable; or
(b) in all the circumstances of the case, is not practicable to verify.
11.39
The regulatory experience of how the Commissioner dealt with data correction requests
relating to “expression of opinion” was explained in paragraphs 11.27 to 11.33 above.
Data users must observe the procedural requirements laid down in section 25 to notify
the data subject about the refusal.
11.40
An illustration of how section 25(2)(b)(i)(B) has been applied by the Commissioner can
be found in a complaint brought against an educational institution, where it was found
that the institution had kept, in two of its departments, the same record of an expression
of opinion about a staff member. In response to a data correction request from the staff
member, the educational institution caused a note under section 25(2)(b)(i) to be
annexed to the record kept in one department, but omitted to do the same to the
record kept in the other department. As a result of this omission, the educational
institution was found to have contravened section 25(2).
11.41
As provided by section 25(3), the meaning of “expression of opinion” shall include an
assertion of fact which is unverifiable or in all the circumstances of the case, is not
practicable to verify, such that the data user can likewise make a note in accordance
with section 25(2)(b). In AAB No.50/2009, the appellant made a data correction request