They might have deduced it from other data they have obtained legitimately, but as it's still data about you they have, they should tell you it and if it's incorrect you should be able to ask them to delete it.