Four years after the conclusion of an investigation into suspected plagiarism in an educational setting, an individual requested to have aspects of the internal report regarding the investigation rectified. The report was compiled following an independent investigation in which the individual was interviewed as a witness and not as the subject of the investigation.

The individual submitted the rectification request to the data controller, the individual’s employer. As part of their request, the individual stated that there were a number of instances where the personal data in the report was inaccurate, incomplete or misleading, and requested that these instances be rectified in accordance with Article 16 of the GDPR. In its response to the individual, the education provider stated that it could not rectify the report but it could restrict access to it. As the individual was dissatisfied with this response, they submitted a complaint to the DPC.

In this instance, the DPC examined whether the educational provider was correct in its initial refusal of the rectification request. The education provider confirmed to the DPC that due to the passage of time since the report had been created, the investigator’s notes had been destroyed as such it was unable to check the alleged inaccuracies and that as it was not the author of the report it could not alter the contents. The education provider offered, as a proposal for amicable resolution, to add a supplementary statement recording the individual’s position to the report.

The individual refused the proposal as they were of the view that the report was incomplete as not all the evidence they provided was referred to in the report, and where it was quoted, they felt it was taken out of context.

It is important to note, that it is not the role of the DPC, nor is it encompassed within the right to rectification under Article 16 of the GDPR, to reassess or to repeat the work of an independent investigator, nor to undermine the professional opinion of an expert. The independent investigator provided their professional assessment of all evidence and testimony gathered during the investigation, and it was their professional discretion as to what material was relevant to be included in the report. The purpose of the individual’s testimony was to inform the independent investigator in order to assist with the investigation. The fact that the individual disagrees with the assessment did not constitute the report as being inaccurate or incomplete.

The education provider further offered to delete the report which would cease the processing of the individual’s personal data. Once again, the individual did not accept this offer.

The DPC was of the view that the report should be erased where it was no longer necessary for the education provider to retain it. Alternatively, the education provider should add the supplementary statement to provide a more accurate account of the events.