By Jess Pembroke, Director of Information Law Services
I recently stumbled across something that gave me a chuckle — and then a pause for thought. While browsing an online bookstore for a specific Mr. Men book my son requested, I found one that was supposedly part of the cheerful children’s series. But the description was… unexpected.
Instead of the typical light-hearted tale of Mr. Tickle or Mr. Bump, the blurb read:
“This book offers a response to the inadequate examination of the Midwest in Civil Rights Movement scholarship — scholarship that continues to ignore the city of St. Louis and the Black liberation struggle that took place there. Jolly examines this local movement and organisations such as the Black Liberator.”1
Needless to say, it wasn’t quite what I was expecting from a Mr. Men book. It was a reminder of how easily things can go wrong in the databases that run our businesses and infrastructure.
This was perhaps a mis-linked ISBN, an incorrect metadata entry, or an automated cataloguing system that went awry. With so many records and so few humans manually checking them, it’s easy to see how mistakes like this can slip through.
But while it’s amusing when it happens with a children’s book, it underscores a deeper issue: accuracy matters, especially now that scale and automation are the norm.
Inaccuracies can have big impacts when the database is about personal data. Misdescriptions, mislabelling, or misidentifications can cause anything from inconvenience to serious harm. Think of what happens when:
- A health record incorrectly lists an allergy.
- A job applicant is misidentified by a background check database.
- A financial system confuses two people with similar names and denies a loan.
These systems rely heavily on automation and metadata — and very little on human review. As users, we assume they’re accurate. But clearly, they’re only as good as the data that feeds them.
When we talk about data protection, we often focus on privacy — and rightly so. But data accuracy is just as vital. The UK’s Data Protection Act and GDPR both include principles that require data to be “accurate and, where necessary, kept up to date.” That’s not just a box-ticking legal requirement; it’s a safeguard against systemic errors that can affect real lives.
What should we do to ensure accuracy:
- Implementation: when introducing new software or services accuracy should be considered. What kind of error checking is done; what assurances do we ask suppliers about migrating datasets from old systems. Completing a DPIA is a good way to document this.
- Complaints: Ensure your complaints process accepts that computers aren’t always right. See this case of where a Football fan had to use CCTV to prove his attendance because the staff wouldn’t believe him.2
- Data Rights: Ensure staff are trained to handle data accuracy issues correctly, it doesn’t always need to be some enquiries may need consideration under data rights processes (right to rectification)
So yes — I smiled at the idea of a Mr. Men character leading a Black liberation movement in 1960s St. Louis. But I also took it as a small warning from the data gods: in a world run by algorithms, a little human oversight goes a long way.
As we build ever-larger databases and automate more systems, let’s remember that accuracy is a fundamental part of data protection that needs to be considered during the project’s lifecycle.
Interested in understanding more about your responsibilities when individuals exercise their rights under data protection law? Our CPD UK accredited Data Protection Rights course skilfully explores the management of Data Subject Access Requests with scenarios that guide participants through the essential steps involved in handling requests compliantly. Next running 17 September, 9:30am-1pm, to find out more and book your place visit https://www.eventbrite.co.uk/e/1054713970879.
Alternatively, are you looking to learn more about the requirements of Privacy by Design and Data Protection Impact Assessments (DPIA)s? Our Privacy by Design course uses mock examples of a DPIA to walk through the necessary steps and legal considerations. This course is ideal for professionals involved in data protection, but also applicable to those responsible for the procurement of products, services or systems which involve the handling and processing of personal data. Next running 15 October, 9:30am-1pm, to find out more and book your place visit https://www.eventbrite.co.uk/e/1047970476907.
If you have any queries or would like more information about our training, please get in touch. We look forward to hearing from you!