Part 6: Enforcement Section 151: Enforcement notices: rectification and erasure of personal data etc
Subsection (1) makes it clear that this section applies where the enforcement notice relates to the controller or processor’s failure to comply with the data protection principle relating to accuracy (as defined in subsection (8)). The section also applies where a controller or processor has failed to comply with a data subject’s rights to rectification, erasure or restriction of processing under Articles 16 to 18 of the GDPR or section 46, 47 or 100.
	Subsection (2) states that if an enforcement notice requires a controller or processor to rectify or erase inaccurate personal data, it may also require the controller or processor to rectify or erase any other data containing an expression of opinion based on the inaccurate personal data. For example, if a bank holds inaccurate data about an individual’s credit card repayments which leads them to conclude that person is not creditworthy, the Commissioner can require that data and any inaccurate conclusions flowing from it to be rectified or erased.
	Subsection (3) sets out that if a data controller or processor has accurately recorded personal data provided by the data subject or a third party, which is later found to be inaccurate, the enforcement notice may require the controller or processor to ensure the data is rectified, or to supplement it with the data subject’s view that the data is inaccurate, or a statement of the true facts relating to the matters dealt with by the data.
	When considering what steps should be specified in an enforcement notice to rectify inaccurate data, subsection (4) provides the Commissioner must have regard to the purpose for which the data was obtained and further processed.
	Subsections (5) to (7) provide that an enforcement notice may require the controller or processor to notify any third parties to whom the data may have been disclosed of the rectification or erasure. The Commissioner must have regard to the number of people who would need to be notified when considering whether such notification would be practicable.