The right to object

When does the right to object apply?

Individuals have the right to object to:

• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
• direct marketing (including profiling); and
• processing for purposes of scientific/historical research and statistics.

How do I comply with the right to object?

If you process personal data for the performance of a legal task or your organisation’s legitimate interests

Individuals must have an objection on “grounds relating to his or her particular situation”.

You must stop processing the personal data unless:

• you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or
• the processing is for the establishment, exercise or defence of legal claims.

You must inform individuals of their right to object “at the point of first communication” and in your privacy notice.

This must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.

If you process personal data for direct marketing purposes

You must stop processing personal data for direct marketing purposes as soon as you receive an objection. There are no exemptions or grounds to refuse.

You must deal with an objection to processing for direct marketing at any time and free of charge.

You must inform individuals of their right to object “at the point of first communication” and in your privacy notice.

This must be “explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”.

These requirements are similar to existing rules under the DPA.

If you process personal data for research purposes

Individuals must have “grounds relating to his or her particular situation” in order to exercise their right to object to processing for research purposes.

If you are conducting research where the processing of personal data is necessary for the performance of a public interest task, you are not required to comply with an objection to the processing.

If your processing activities fall into any of the above categories and are carried out online:

You must offer a way for individuals to object online.