Correcting a customer’s record

The five testsWhat makes information wrong

APP 13 names five qualities a record must have: accurate, up to date, complete, relevant and not misleading. The Act does not define them, so the OAIC’s guidelines explain each one, judged against the purpose the information is held for.

Inaccurate

It contains an error or defect, such as a wrong name, date of birth, address or employment detail.

Out of date

It contains facts, opinions or other information that are no longer current.

Incomplete

It gives a partial or misleading picture rather than a true or full one.

Irrelevant

It has no bearing on, or connection to, the purpose it is held for.

Misleading

It conveys a meaning that is untrue or inaccurate, or could lead someone reading it into error.

One line in the guidelines matters for opinions kept in a file: an opinion about a person “given by a third party is not inaccurate by reason only that the individual disagrees with that opinion or advice”.

Two triggersA request is not the only reason to fix a record

The duty starts in two ways. One is a request from the person. The other is the business itself becoming satisfied, without any request, that something it holds is wrong for the purpose it is held. A sales note found to be out of date during an ordinary review falls under the same rule as one the customer complains about.

The requestHandling a request, in order

1. Take it however it comes

   There are no formal requirements for a correction request; a business may ask a person to use a form, but cannot require it. The privacy policy should say how a person can seek a correction (APP 1.4(d)).

2. Check who is asking

   The request should come from the person or someone authorised for them, such as a legal guardian, power of attorney or authorised agent. The OAIC prefers sighting identity documents to copying and keeping them, and says corrections should not be made if the business is not sure of the person’s identity.

3. Find every copy

   The OAIC suggests searching hard copy records and electronic databases, and asking staff or contractors who know the matter; talking with the person may also help locate it.

4. Decide whether it is wrong

   If the business is satisfied the information is incorrect for its purpose, it must correct it. If it is not yet satisfied, it may ask the person for more information or an explanation.

5. Make the change

   Reasonable steps can mean adding, deleting or altering, or declining where a step would be unreasonable; sometimes it may be appropriate to destroy or de-identify the information. A correction is not excused only because it would be inconvenient, time-consuming or cost something. The OAIC also notes that an organisation may have a legal need to keep some information for a certain period, and so may not be able to amend or delete it during that time.

RefusalWhen the business disagrees

Sometimes the business looks at the record and decides it is right. The Act then asks for two things.

First, a written notice. Under APP 13.3 it gives “the reasons for the refusal except to the extent that it would be unreasonable to do so”; it must also describe “the mechanisms available to complain about the refusal”, plus any other matter the regulations prescribe.

Second, the statement. The person can ask the business to associate with the information a statement that they believe it is inaccurate, out of date, incomplete, irrelevant or misleading, and the business must take reasonable steps to associate it “in such a way that will make the statement apparent to users of the information”. The OAIC says a business that refuses should tell the person they can ask for this, and that a statement should generally not be more than one page.

For a digital record, the OAIC’s guidelines give the example of linking the statement electronically to the record, and say the statement should be associated with all records containing the information claimed to be incorrect.

APP 13.2Copies already sent elsewhere

Records travel. If the person asks, a business that corrects information it earlier gave to another APP entity must take reasonable steps to tell that entity about the correction, unless that would be impracticable or unlawful. The OAIC suggests telling people they can make that request at the time of the correction, or as soon as practicable after, and calls it good practice to send a notice of the correction naming any third parties told about it.

A person can complain to the Information Commissioner about a business’s failure to take reasonable steps to correct their information.