DPA case CDP/COMP/583/2022 (asylum authority) – Order (Malta, 2023)

In CDP/COMP/583/2022, digitally signed on 22 May 2023, Malta’s Information and Data Protection Commissioner found that an anonymised asylum authority infringed Article 16 GDPR by refusing to rectify a beneficiary of subsidiary protection’s marital information. She had knowingly supplied a different spouse name for security reasons and a traditional-marriage date when applying in 2016, and later provided a public civil-marriage certificate supporting correction. The Commissioner distinguished an accurate historical record of what had originally been declared from the controller’s continuing duty to keep current data accurate and up to date, reading Article 16 with Articles 5(1)(d) and 5(2). Under Article 58(2)(c), the authority was ordered to rectify the record and take necessary internal measures without undue delay and within 20 days of receipt, then confirm compliance. It could retain the original information as an accurate historical account of the application. No administrative fine or general erasure of the historical record was ordered. The October 2023 PDF creation/upload timing is not the visible May 2023 signing date, and no later appeal or finality is established.