Answer given by Ms Jourová on behalf of the European Commission
29.5.2019
The Commission has taken note of the ruling made by the Irish Data Protection Commission in the case referred to by the Honourable Member.
Pursuant to Article 16 of the General Data Protection Regulation (GDPR)[1], the data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Account must be taken that, as stated in Recital 4 of the GDPR, the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.
The monitoring and enforcement of the application of the data protection legislation falls under the competence of national authorities, in particular data protection authorities and courts. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. If not satisfied with the decision of the Irish Data Protection Commission, the data subject may therefore initiate proceedings against the authority before the competent national court, in accordance with national law.
- [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1‐88.