Individuals
have a right to correction of their personal data under data protection
legislation. This also applies to medical data.
If you have
a good relationship with your GP/doctor/nurse/ other you could try to explain and
ask that incorrect information on your medical record be changed/deleted.
If for
whatever reason you can’t or don’t want to discuss this with your
GP/doctor/nurse/other, or have tried to discuss the matter already without success, you can
write a Request to rectification letter to the practice. See information about this below.
Requesting
Rectification to a private GP/other private healthcare provider
Step 1.
The first
step is to send a rectification (correction) request to your GP
Surgery/Practice which will go to the practice’s Data protection Officer or
passed to another relevant person. Send by email to the GP practice with
subject line ‘For the attention of the Data Protection Officer,’ or post to
your practice with same on envelope.
Template
letter
The Request to Rectification Letter could be a simple letter
e.g.
Dear
Sir/Madam,
In
accordance with Data Protection legislation, I seek an amendment of my personal
data held by Dr x/Nurse x/other.
I claim that
the record/s described below contain/s information relating to my personal data
that is inaccurate meaning: incomplete/incorrect/misleading.
The
information which I believe is incomplete/incorrect/ misleading (please attach
relevant copy of record if you have that) is as
follows:
………………………………………………………………………………..
………………………………………………………………………………..
………………………………………………………………………………..
The reasons
why I claim the information is incomplete/ incorrect/misleading are:
…………………………………………………………………………………
……………………………………………………………………………………
…………………………………………………………………………………….
I want the
line that says ‘…..’ completely removed/amended to acknowledge my reality/the
reality of my illness and situation because ……….
Please amend
to say ‘…..’ or ‘no suggestion to replace, please leave blank.’
If I don’t
hear back from you within 30 days or if the matter has not been rectified to my
satisfaction, I will be taking the matter up with the Data Protection
Commissioner.
I understand
that I have a right to have incorrect information on my medical file amended as
per
(1) Article 5(1)(d) of the General Data
Protection Regulation (GDPR) states that: “Personal data shall be … accurate
and, where necessary, kept up to date; every reasonable step must be taken to
ensure that personal data that are inaccurate, having regard to the purposes
for which they are processed, are erased, or rectified without delay.”
And
(2) Article 16 GDPR states: “The data
subject shall have the right to obtain from the data controller without undue
delay the rectification of inaccurate personal data concerning him or her.
Taking into account the purposes of processing, the data subject shall have the
right to have incomplete personal data completed, including by means of
providing a supplementary statement.”
Yours Sincerely,
Included in
the above: -
You should
state in your letter what personal data you believe is incorrect, misleading,
or incomplete and what you want changed. You should also provide evidence that
will support the changes you request if you can.
If your
personal data is incomplete, you have the right to have the data completed.
This can be done by providing the supplementary information.
It is a good
idea to keep a copy of what you send in your request for rectification in case
you need to carry out step 2, i.e., complain to the Data Protection Commission
so that you can include evidence of your attempt to rectify with your
GP/doctor/other.
Step 2.
What can I
do if I am unhappy with the outcome of an access request?
You may be
unhappy with the way your request was handled because:
· There was no response or a delayed
response to your access request
· The response to the request was
incomplete
If you are not satisfised with the outcome of your rectification request to your GP you can contact the Data Protection Commissioner, outlining the situation. Please send your complaint to email address info@dataprotection.ie or complete the Data Protection Commissioner webform here
How do I
make a complaint?
You will be
asked to provide evidence to support your complaint. This includes:
· Evidence of your access request
· Correspondence between you (or your
legal representative) and the data controller and
· information in support of your belief
that the data controller holds incorrect personal information about you
The Data
Protection Commissioner (DPC) is Ireland’s independent authority with
responsibility for upholding the right of people in the EU to have their
personal data protected. It monitors compliance with GDPR and other data
protection legislation and deals with complaints in relation to data protection
breaches. The DPC website contains helpful explanations of data protection law.
Step 3.
The Data
Protection Commissioner will get an officer onto your case who will contact you/process
your complaint.
What the
right to rectification means in practice will depend on the circumstances of
each case and the Data Protection Commission (DPC) examines each case that
comes before it on its individual merits.
In general,
data controllers will be required to take all reasonable steps to ensure the
accuracy of personal data, taking account of the circumstances of the case, the
nature of the personal data and, in particular, the purposes for which they are
processed.
The notion
of accuracy has to be interpreted in light of Article 5(1)(d) of the GDPR which
states that every reasonable step must be taken to ensure that personal data
that are inaccurate, having regard to the purposes for which they are
processed, are erased, or rectified without delay.
See more
here:
- https://www.dataprotection.ie/
- https://www.dataprotection.ie/en/dpc-guidance/blogs/examination-right-rectification-complaints
Requesting
rectification to a public GP/doctor other healthcare provider i.e., via
the HSE
The Data
Protection legislation gives you the right to ask to have personal data on a
record about you held by the HSE amended, where it can be established that the
information is incorrect.
If your
personal data is incomplete, you have the right to ask to have data completed,
including by means of providing supplementary information.
The right of
rectification is restricted in certain circumstances under Section 60 of the
Data Protection Act 2018, which provides for restrictions that are necessary
for important objectives of public interest, and by Section 43 of the Act which
seeks to balance the right of rectification with the right of freedom of
expression and information.
How do
you do this?
You must
state in writing what personal data you believe is incorrect, misleading, or
incomplete and what you want changed. You should also provide evidence that
will support the changes you request.
Alternatively, you should complete the Request for Rectification form and send it to the relevant Deputy Data Protection Officer listed in the contact list on the last page of the form and here
The HSE
decision maker may need to contact you if additional information is required.
Here is the Request for Rectification form to be completed
Can you
appeal against the decision?
If you are not satisfied with the decision on your application, you may make a complaint to Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, or How to contact us | Data Protection Commissioner
