Hi
This is a clear breach of at least one of the eight data protection principles in the Act that define the duties of people who collect and provide personal data.
These are:
* personal data must be processed fairly and lawfully, and usually only with the subject's consent. Consent should be given freely if pertinent information is insufficient and not while under duress
* data should only be processed for specified and lawful purposes
* data must not be excessive to the purpose(s) for which it is processed;
* data must be accurate and kept up to date;
* data must not be kept longer than the purpose requires;
* the data subject's rights must be protected (these rights are detailed within sections 7 to 14 of the Act);
* data must be safeguarded against misuse or accidental loss;
* data must not be transferred outside the European Economic Area without the assurance of adequate protection (this issue has led to the 'safe harbor' agreement).
I think you should be able to have them change the data under section 14 of the Data Protection Act 1998.
Quote:
14. - (1) If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data. |
You may have to issue a claim against them in order that they pay attention to you though, but I doubt that they will argue for too long.