|
|
|
Correction of inaccurate data, destruction of incorrectly supplied data and storage of data
|
| |
|
|
| |
125. (1) Whenever, whether on notification from a data subject or otherwise, it comes to the attention of a national contact point that data supplied under Chapter 2 or 3 are either incorrect or should not have been supplied, the national contact point shall, as soon as practicable, inform the national contact point of the designated state concerned that received the data of that fact and request that national contact point to correct or destroy, as may be appropriate, the data concerned.
|
|
| |
(2) Whenever, whether on notification from a data subject or otherwise, it comes to the attention of a data controller that data supplied pursuant to an Article 7 request are either incorrect or should not have been supplied, the data controller shall, as soon as practicable, inform the authority in the Member State concerned or Iceland or Norway, as the case may be, that received the data of that fact and request that authority to correct or destroy, as may be appropriate, the data concerned.
|
|
| |
(3) If—
|
|
| |
(a) a national contact point receives data under Chapter 2 or 3 without requesting them, or
|
|
| |
(b) a data controller receives data pursuant to an Article 7 request without requesting them,
|
|
| |
the national contact point or the data controller, as the case may be, shall immediately check whether the data are necessary for the purpose for which they were supplied by the national contact point of the designated state concerned or the authority in the Member State concerned or Iceland or Norway, as may be appropriate.
|
|
| |
(4) Whenever, whether on notification from a data subject or otherwise, it comes to the attention of a national contact point that data received under Chapter 2 or 3 are either incorrect or should not have been supplied, the national contact point shall, after consultation with the national contact point of the designated state that supplied the data, correct or destroy, as may be appropriate, the data concerned.
|
|
| |
(5) Whenever, whether on notification from a data subject or otherwise, it comes to the attention of a data controller that data received pursuant to an Article 7 request are either incorrect or should not have been supplied, the data controller shall, after consultation with the authority in the Member State concerned or Iceland or Norway, as the case may be, that supplied the data, correct or destroy, as may be appropriate, the data concerned.
|
|
| |
(6) Subject to subsection (8), a national contact point shall destroy data received pursuant to Chapter 2 or 3 when they are no longer required for the purpose for which they were supplied and, in any event, shall do so not later than the expiration of the maximum period (if any) prescribed by the law of the designated state concerned and specified by the national contact point of that designated state at the time the data were supplied.
|
|
| |
(7) Subject to subsection (8) and notwithstanding section 77(7) of the Act of 2008, a data controller shall destroy data received pursuant to an Article 7 request when they are no longer required for the purpose for which they were supplied and, in any event, shall do so not later than the expiration of the maximum period (if any) prescribed by the law of the Member State concerned or Iceland or Norway, as the case may be, and specified by the authority in that Member State or Iceland or Norway, as the case may be, at the time the data were supplied.
|
|
| |
(8) Where, under subsection (6) or (7), a national contact point or a data controller, as the case may be, reasonably believes that the destruction of the data concerned would prejudice the interests of the data subject, the data shall instead be blocked and those data may be supplied or otherwise further processed only for a purpose relating to the protection of those interests.
|
|
| |
(9)(a) If a data subject contests the accuracy of data supplied or received pursuant to Chapter 2 or 3 and the accuracy of those data cannot be ascertained, the national contact point shall, as soon as reasonably practicable, inform the data subject accordingly.
|
|
| |
(b) If the data subject so requests, the national contact point shall note on those data that the accuracy of them cannot be ascertained, and such a note may be removed only if—
|
|
| |
(i) the data subject consents to its removal, or
|
|
| |
(ii) the Data Protection Commissioner or the Circuit Court, on application made to the Commissioner or the Court in that behalf, is satisfied that the note may be removed.
|
