The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014

Rectification, erasure and blocking

31.—(1) A UK competent authority must—

(a) rectify personal data which are inaccurate;

(b) complete or update personal data where that is possible and necessary;

(c) erase personal data or make them anonymous where they are no longer required for the purposes for which they were lawfully collected or are lawfully further processed.

(2) Nothing in paragraph (1)(c) precludes a competent authority from archiving the data in a separate dataset for an appropriate period in accordance with an enactment or rule of law.

(3) Personal data must be blocked instead of erased if the competent authority has reasonable grounds to believe that erasure could affect the legitimate interests of the data subject and, once blocked, that data shall be processed only for the purpose which prevented their erasure.

(4) When the personal data are contained in a judicial decision or record related to the issuance of a judicial decision, rectification, erasure or blocking is permitted only where it complies with an enactment or rule of law regarding judicial proceedings.

(5) A competent authority which refuses to rectify, erase or block data under paragraph (1), having been asked by the data subject to do so, must give notice of its decision in writing to the data subject within a reasonable period of making it.

(6) That notice must inform the data subject that they may make a complaint about the refusal to the Commissioner.

(7) The Commissioner must examine any such complaint and, having done so, inform the data subject of whether or not the competent authority acted properly.

(8) If the accuracy of an item of personal data is contested by the data subject and its accuracy or inaccuracy cannot be ascertained, that item may be marked for the purpose of indicating that its accuracy or inaccuracy cannot be ascertained.