In short. The GDPR accuracy principle requires accurate personal data, necessary updates and reasonable steps to correct or erase inaccuracies without delay.

Definition: Article 5(1)(d) of the General Data Protection Regulation (GDPR) requires personal data to be accurate and, where necessary, kept up to date. Every reasonable step must be taken to erase or rectify inaccurate personal data without delay, having regard to the purposes of processing.

Key facts

The GDPR's Article 5 places responsibility for compliance, and for demonstrating compliance, on the controller.
The European Data Protection Board's ChatGPT taskforce report, dated 23 May 2024, distinguishes accuracy of input data from accuracy of output data.
The GDPR's Article 16 gives individuals a right to rectification of inaccurate personal data concerning them without undue delay.

What information and responsibilities does Article 5 cover?

Personal data means information relating to an identified or identifiable natural person. A controller is the person or organisation that determines the purposes and means of processing. These definitions appear in Article 4. Processing includes collection, use and dissemination, so the accuracy question extends to personal information communicated in an answer where the GDPR applies.

The accuracy provision links correction to the purposes for which the data is processed. It requires every reasonable step to address inaccurate personal data and requires updates where necessary. Article 5(2) adds accountability: the controller must be able to demonstrate compliance.

The provisions relevant to an accuracy review are:

GDPR Article 5(1)(d): accuracy
GDPR Article 5(2): accountability

Applied to a website publishing personal information, this means reviewing the accuracy of that information against its publishing purpose and correcting or erasing inaccuracies without delay. The same accountability provision makes evidence of the review and action taken relevant to demonstrating compliance.

How does the principle relate to AI answers?

In its taskforce report, the EDPB describes inputs as including data collected through web scraping and information supplied in prompts. Outputs are the answers produced through interactions with ChatGPT. The report presents preliminary views that leave individual supervisory investigations to their respective authorities.

The report explains that probabilistic text production can produce fabricated information about individuals that users perceive as factual. It states that the accuracy principle must still be complied with. Information explaining unreliable outputs helps transparency, but the report considers those transparency measures insufficient on their own to satisfy accuracy.

For an accuracy review, the report's annex asks for documentation of how personal data accuracy is measured and assessed in training, testing and validation data, and in model outputs. This gives a concrete distinction between examining source data and examining answers about people.

What happens when a person disputes an answer?

The GDPR's rights provisions connect accuracy to remedies. Article 16 covers correction of inaccurate personal data and completion of incomplete data, taking the processing purposes into account, including through a supplementary statement.

Article 18(1)(a) provides a right to restriction of processing when the individual contests accuracy, for the period needed by the controller to verify it. A correction request and a restriction request therefore address different parts of handling a disputed personal statement: correcting the information and limiting processing while accuracy is checked.

FAQ

How quickly must a controller respond to my request?

Under Article 12(3), you receive information on action taken without undue delay and within one month of receipt. Complexity and the number of requests can justify an extension of two further months; the controller must inform you of the extension and its reasons within the initial month.

Can I ask for incomplete information about me to be completed?

Yes. Article 16 in the same GDPR chapter allows you to have incomplete personal data completed, taking account of the processing purposes, including by providing a supplementary statement.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer