Part 3: Law enforcement processing Chapter 3: Rights of the data subject Sections 46 to 48: Data subject’s rights to rectification or erasure etc
These sections enable a data subject to ask for data to be corrected, erased or the processing of that data to be restricted. The data subject may challenge the processing of the data directly to the controller. Correction can include adding to incomplete personal data, for example by means of the provision of further information. The right to rectification applies, in particular, to matters of fact. For example, there may be inaccuracies in the details of a criminal conviction held on the Police National Computer – an individual may receive a copy of their criminal record and request that an incorrect entry for Grievous Bodily Harm be corrected to Actual Bodily Harm, or vice versa, to reflect the correct conviction. The controller may restrict the right to rectification where, for example, it would obstruct an investigation, such as a request to rectify the content of a witness statement. An underlying assumption would be to restrict data processing rather than to erase it in cases where erasure can affect the interests of the data subject or a third party. Restricted data should be processed only for the purpose which prevented its erasure.
	Restrictions on the processing of data may be given effect by moving the data to another system, for example for archiving purposes, or making it unavailable by applying strict access controls. The fact that the processing of the personal data is restricted should be indicated on the system, for example, through flagging.
	Where a data subject’s request for rectification or erasure has been refused, the data subject must be informed of the reasons for the refusal. Again, it is open to a controller not to provide such reasons where, to do so, is necessary and proportionate for the purposes specified in subsection (3) of section 48.
	Where this restriction has been exercised by the controller, the data subject may lodge a complaint with the Commissioner. Sections 165 and 166 make further provision in respect of complaints by data subjects.
	If a controller has rectified, erased or restricted processing for certain data, there is a duty on the controller to inform the competent authority from where the data originated (if different) and to alert any recipients of the data. This is particularly important if data has been transferred internationally (see Chapter 5 of Part 3 for more detail on international transfers).