For example, suppose the statement: "Ms X has entered
internationally sanctioned Country Y on a business visa"
is recorded in your database. If this statement about
Ms X is incorrect and Ms X and her business are, in fact,
prohibited under international sanctions from conducting
business in Country Y, Ms X might reasonably submit a
request to you that the incorrect statement be corrected.
It is by no means certain that a regulator or a court would
regard it as a sufficient rectification if you were simply to
update your database to say: "Ms X did not enter Country
Y on a business visa. This statement is actually incorrect;
Ms X has not done business in a country subject to
international sanctions." Indeed, Ms X may well not
be satisfied with this and demand that all evidence of
the initial statement to be deleted and replaced with a
correct statement.
By contrast, however, there may be cases where it is not
appropriate to erase personal data, even if incorrect, in
order to replace it with correct information. One example
is data that serves an evidential purpose, such as a
signed contract. It may not be appropriate to modify a
signed contract to, for example, correct a mistake in the
job title of an individual named in the contract. It may
be preferable to attach a clarificatory statement to the
contract, so that the contract can still serve as evidence of
the exact, unaltered terms of the agreement the parties to
the contract reached.
It is unclear whether a regulator or a court would ever
regard a supplementary statement as sufficient to
comply with the Article 16 GDPR right to rectification
of inaccurate personal data. Unfortunately this is an
area where there is no reliable guidance from regulators,
making it a further issue on which we would urge the
relevant regulatory bodies to provide clear guidance on.
3 - Potential solution: Rectification by deletion
To the extent it is not possible to comply with the
obligation to rectify incorrect personal data by a
supplementary statement, it would be necessary to
look to the methods outlined above to enable deletion
of incorrect personal data (for example, deletion by
encryption) followed by addition of the correct personal
data to the blockchain. Because a data subject might
request that incorrect personal data about them of any
age be rectified, pruning of the blockchain may not offer
an effective solution.
Pending guidance from a data protection regulator that in
certain circumstances a supplementary statement might
be sufficient, it is prudent to ensure any GDPR-governed
blockchain solution facilitates the effective deletion of
incorrect personal data and permits correct personal data
to be substituted in its place.
34 I GDPR and the Blockchain