Any individual (the "objector ") given—
(a) information under Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) by a credit reference agency, or
(b) information under section 158,
who considers that an entry in his file is incorrect, and that if it is not corrected he is likely to be prejudiced, may give notice to the agency requiring it either to remove the entry from the file or amend it.
Within 28 days after receiving a notice under subsection (1), the agency shall by notice inform the objector that it has—
(a) removed the entry from the file, or
(b) amended the entry, or
(c) taken no action,
and if the notice states that the agency has amended the entry it shall include a copy of the file so far as it comprises the amended entry.
Within 28 days after receiving a notice under subsection (2), or where no such notice was given, within 28 days after the expiry of the period mentioned in subsection (2), the objector may, unless he has been informed by the agency that it has removed the entry from his file, serve a further notice on the agency requiring it to add to the file an accompanying notice of correction (not exceeding 200 words) drawn up by the objector, and include a copy of it when furnishing information included in or based on that entry.
Within 28 days after receiving a notice under subsection (3), the agency, unless it intends to apply to the the relevant authority under subsection (5), shall by notice inform the objector that it has received the notice under subsection (3) and intends to comply with it.
If—
(a) the objector has not received a notice under subsection (4) within the time required, or
(b) it appears to the agency that it would be improper for it to publish a notice of correction because it is incorrect, or unjustly defames any person, or is frivolous or scandalous, or is for any other reason unsuitable,
the objector or, as the case may be, the agency may, in the prescribed manner and on payment of the prescribed fee, apply to the relevant authority, who may make such order on the application as he thinks fit.
If a person to whom an order under this section is directed fails to comply with it within the period specified in the order he commits an offence.
The Information Commissioner may vary or revoke any order made by him under this section.
In this section "the relevant authority " means—
(a) where the objector is a partnership or other unincorporated body of persons, the FCA, and
(b) in any other case, the Information Commissioner.