Starting point: Correction according to Art. 16 GDPR and the question of the burden of proof
The General Data Protection Regulation grants data subjects the right to have incorrect personal data corrected (Art. 16 GDPR). In practice, the preliminary question often arises as to who is responsible for presenting and proving the inaccuracy or accuracy of the information in dispute. This is also related to distinguishing scenarios where it is not a ‘false fact’, but an evaluation, suspicion, or classification at issue.
Standard of ‘inaccuracy’ and differentiation from evaluations
Factual statements as the subject of the right to correction
The right to correction is linked to the quality of the processed information: the subject matter is personal data that have a concrete factual core and can be objectively correct or incorrect. Only for such data does it make sense to speak of “accuracy” or “inaccuracy” at all.
Value judgments and classifications
Not every stored or published piece of information is a fact capable of being corrected under Art. 16 GDPR. As far as it concerns evaluations, assessments, or conclusions, the standard of objective accuracy applies only to a limited extent. Thus, the data protection correction mechanism is not readily an instrument for correcting substantive evaluations.
Who must prove the inaccuracy?
Cooperation of the data subject
In disputes over a sought correction, it is typically expected that the data subject identifies the facts that, from their perspective, justify the inaccuracy of the processed data. Only on this basis can the controller assess whether the processing is factually correct or if an adjustment needs to be made.
Verification and response obligations of the controller
The controller is not limited to merely receiving requests in a formal manner. He must categorize a correction request and verify whether the stored data are correct. What evidence is required or reasonable depends on the context of the processing, the data source, and the nature of the information.
No blanket rule of evidence ‘against’ only one side
A rigid, universally valid allocation of the burden of proof exclusively to one party cannot be readily generalized in this context. The circumstances of the individual case are more decisive: the nature of the data, the origin of the information, the documentation status, verification obligations, and the specific structure of the subject matter.
Special scenarios: Allegations and ongoing proceedings
Suspect reporting and data protection classification
Where data reflect a suspicion or a situation not yet conclusively clarified, the issue is different from established facts. In such cases, it is not just about ‘right’ or ‘wrong’, but about the correct representation of the status: whether a suspicion indeed exists, how it is substantiated, and whether the presentation as a suspicion remains sufficiently identifiable.
Presumption of innocence and source situation
With reference to ongoing proceedings, special restraint is required. As long as there is no final decision, the presumption of innocence must be observed with regard to personal data related to proceedings. It also depends on whether and to what extent the information is based on reliable sources and whether the data processing accurately reflects the character and limits of the source.
Relation to other data subject rights (classification instead of anticipation)
The right to correction is related to other data subject rights, particularly the right to erasure (Art. 17 GDPR) and to restrict processing (Art. 18 GDPR). Which legal consequence is ultimately applicable depends on whether an objective inaccuracy exists, whether the data are merely incomplete, or whether the processing is subject to another legal conflict (such as the permissibility of storage as such). The correction right is not intended to preemptively address factual issues without a basis in objectively verifiable criteria.
Case dependency and practical relevance for companies
Companies process personal data in different roles and systems – internally, in corporate structures, within compliance processes, in customer and contract relationships, or in public contexts. Depending on the data category and purpose of use, the question of how ‘accuracy’ is determined and what evidence may be required can vary significantly. Consequently, the assignment of presentation and verification obligations is regularly shaped by the specific facts.
Transition: Need for clarification in correction, evidence, and procedural reference
Where correction requests intersect with disputed facts, suspicions, or ongoing proceedings, a tension often arises between the rights of the data subject and the duties and legitimate interests of the controller. If there is a need for clarification, a classification of the data protection requirements in the specific context can be useful. Further information onLegal advice on data protection by MTR Legal Rechtsanwälte can be found at the given link.
