§ 50 DSG NRW
Rights to rectification and erasure and restriction of processing
(1)The data subject shall have the right to obtain from the controller without delay the rectification of inaccurate data concerning him or her. In particular in the case of statements or appraisals, the question of accuracy shall not concern the content of the statement or appraisal. Where the accuracy or inaccuracy of the data cannot be established, restriction of processing shall take the place of rectification. In this case, the controller shall inform the data subject before lifting the restriction. The data subject may also request the completion of incomplete personal data where this is appropriate having regard to the purposes of processing.
(2)The data subject shall have the right to obtain from the controller without delay the erasure of data concerning him or her where their processing is unlawful, where knowledge of them is no longer necessary for the performance of tasks, or where they must be erased to comply with a legal obligation.
(3)Instead of erasing the personal data, the controller may restrict their processing where
(4)1. there is reason to believe that erasure would impair the legitimate interests of a data subject who is a third party,
(5)2. the data must be retained for evidentiary purposes in proceedings serving the purposes of Section 35, or
(6)3. erasure is not possible or is possible only with disproportionate effort due to the particular nature of the storage.
(7)Data whose processing has been restricted pursuant to sentence 1 may only be processed for the purpose that precluded their erasure.
(8)In the case of automated filing systems, it shall be technically ensured that restriction of processing is clearly recognisable and that processing for other purposes is not possible without further review.
(9)Where the controller has carried out a rectification, he or she shall notify the body that previously transmitted the personal data to him or her of the rectification. In cases of rectification, erasure or restriction of processing pursuant to paragraphs 1 to 3, the controller shall notify recipients to whom the data have been transmitted of these measures. The recipient shall rectify or erase the data or restrict their processing.
(10)The controller shall inform the data subject in writing about any refusal to rectify or erase personal data or about restriction of processing taking the place thereof. This shall not apply where the provision of this information itself would give rise to a risk within the meaning of Section 48(2). The notification pursuant to sentence 1 shall be accompanied by a statement of reasons, unless the communication of the reasons would jeopardise the purpose pursued by the refusal to provide the notification.
(11)Section 49(7) and (8) shall apply accordingly.