In short. Where the GDPR applies, Article 16 provides a right to rectification of inaccurate personal data, with controller duties to facilitate and answer requests.
Definition: Yes. Where the General Data Protection Regulation (GDPR) applies, Article 16 gives a person the right to obtain correction of inaccurate personal data concerning them without undue delay. A request about an AI answer engages that right when the relevant processing concerns that person's personal data.
Key facts
- GDPR Article 16, reproduced in the CNIL's text of Chapter III, also covers completion of incomplete personal data, taking account of the processing purposes.
- The European Data Protection Board (EDPB), in its ChatGPT taskforce report dated 23 May 2024, states that technical impossibility cannot justify non-compliance with GDPR requirements.
- The EDPB's guide to individuals' rights explains that controllers must facilitate requests and respond within one month, with an extension possible under specified conditions.
What information and organisation does the right concern?
Personal data means information relating to an identified or identifiable natural person. A controller is the person or organisation determining the purposes and means of processing. GDPR Article 4 defines both terms in the CNIL's reproduction of Chapter I. These definitions direct the request towards the controller responsible for the disputed processing.
Under Article 16 in Chapter III, correction concerns inaccurate personal data about the person making the request. Incomplete data can be completed, including through a supplementary statement, taking the purposes into account. Article 15 also provides access to personal data and, where it was collected elsewhere, available information about its source.
How does EDPB guidance apply to AI answers?
The EDPB's ChatGPT taskforce report presents preliminary views concerning the investigations it describes. Its data-accuracy section distinguishes input data, including information collected from websites, from output produced through interaction with ChatGPT.
The report states that the accuracy principle applies to personal data even though the system can produce made-up outputs. It also says that warnings about output reliability are insufficient to meet that principle. Its rights section calls for easily accessible ways to exercise rights, and its discussion of Article 25 links compliance to data protection by design.
The report leaves the assessment of individual investigations to the supervisory authorities. A particular request therefore requires assessment of the disputed processing and the measures needed to comply with the applicable obligations.
What must the controller do after receiving a request?
GDPR Article 12(3), reproduced in Chapter III, requires information about action taken without undue delay and within one month of receipt. Where necessary because of complexity and the number of requests, the period can extend by two further months. The controller must explain the extension within the initial month.
Article 18(1)(a) gives a person contesting accuracy the right to restriction of processing while the controller verifies it. Restriction limits processing; Article 18(2) permits storage and specifies the conditions for other uses. Under Article 19, the controller must communicate rectification or restriction to recipients of the data unless that is impossible or involves disproportionate effort.
The EDPB's rights guide recommends recording requests, responses and reasons for refusing action. It also explains that additional identity information may be requested where reasonable doubts exist about the applicant's identity.
Related terms
- GDPR right to rectification
- GDPR accuracy principle
- When can a visitor ask a website to restrict data processing?
- How long does a website have to answer a GDPR rights request?
FAQ
How can I frame a correction request?
You can structure your request around the inaccurate data and the correction or completion sought under GDPR Article 16. This suggested structure follows those elements:
I request rectification under GDPR Article 16.
Personal data concerning me that is inaccurate: [statement]
Correction requested: [accurate information]
If incomplete, completion requested: [supplementary statement]
What if the controller refuses to act?
Under Article 12(4), the controller must explain its reasons without delay and within one month, and inform you about complaint and judicial remedies. The EDPB's rights guide identifies the national data protection authority as the complaint route.
Sources
- CNIL, "CHAPITRE III - Droits de la personne concernée", 23 May 2016
- European Data Protection Board, "Report of the work undertaken by the ChatGPT Taskforce", 23 May 2024
- European Data Protection Board, "Respect individuals’ rights", undated
- CNIL, "CHAPITRE I - Dispositions générales", 23 May 2016
Check how a page reads to answer engines. Open the GEO score analyzer