Suppose an AI tool writes something false about you into a company's records, and someone later reports that the error has been "fixed." That word covers four separate jobs, and they are not equally hard:
- Restore the old, correct record.
- Attach a correction marking the earlier entry as wrong, while the entry itself stays. Stores handle refunds this way: the original receipt remains, and the refund slip sits beside it.
- Notify everyone who received the wrong information.
- Repair the harm the wrong information did to you.
European privacy law already counts job 3 as part of fixing. GDPR Article 19 requires a company that corrects someone's personal data to tell each company or person it shared that data with. The duty ends at telling. If a bank refused you a loan because of the bad record, that refusal can stand.
So whether a mistake can be undone depends only partly on the mistake. It also depends on where the false information traveled, how fast, and what people did with it once it arrived.
- The rule: under European and UK privacy law (GDPR), a company that corrects or deletes your information must tell each party that received it.
- Who counts: outside firms hired to handle the data, as well as other businesses.
- The exception: a company may skip a recipient if telling them is impossible or would take disproportionate effort. It has to write down why.
- Who carries the exception: the company does paperwork. You live with whatever uncorrected copy is still out there.
- Right to ask: you can ask a company which parties received your information.
- The logging gap: AI tools typically record the actions they took. They rarely record who received the results, and a recipient nobody wrote down can't be warned.
- Fixing by adding: UK guidance says a wrong diagnosis can remain in a medical record if the later, correct finding is clearly marked.