The Right to Object: GDPR rights explained

The right to object is one of a range of rights the GDPR gives to people to control their personal data and how it is used. Unlike most other rights this is absolute in some circumstances – primarily direct marketing – so it is one for marketers to be aware of. As discussed in previous posts the legal basis for data processing need not be consent. The legitimate interests basis allows people to market their products to potential customers. However, it is important to be careful of people’s rights to control how their data are used for marketing purposes.

What Does the GDPR Say?

Section 99 of the Data Protection Act 2018 makes this right enforceable under British law. However, there are some differences to the right as set out in Article 21 of the GDPR. For example, Section 99 (3) gives data controllers 21 days (rather than 30 days) to act on objections to process data – either by stopping data processing as requested, or explaining if and why you have chosen to override the individual’s objections.

When Can You Use the Right to Object?

You can object to the processing of your personal data in two main scenarios:

• Direct Marketing: You have the absolute right to object to your data being used for direct marketing purposes. This includes profiling related to direct marketing. This applies to all forms of direct marketing, such as email, SMS, or postal mail. The organisation must stop processing your data for this purpose as soon as they receive your objection.
• Other Processing Based on Legitimate Interests: You can object to the processing of your data based on the organisation’s legitimate interests, even if the processing isn’t for direct marketing. However, for the organisation to continue processing your data, they must demonstrate compelling legitimate interests that override your rights and freedoms.

What does objection entail?

Objecting doesn’t necessarily mean your data will be deleted. It restricts how the organisation can use your data. Depending on the reason for your objection, the organisation may need to:

• Stop processing your data: In the case of direct marketing, they must cease using your data for this purpose.
• Restrict processing: For objections based on legitimate interests, they might need to restrict processing until they can demonstrate compelling reasons to override your objection.

How to object

There’s no specific format for an objection request. However, it should clearly state someone’s intention to object to the processing of their data and explain the reason for the objection (e.g., objection to direct marketing, objection based a on your specific situation). Organisations must respond to your objection request within one month.

Important points to remember

• The right to object is distinct from the right to erasure (also known as the “right to be forgotten“). While objection limits the use of people’s data, erasure seeks its complete deletion.
• People can withdraw their objection at any time.
• If the organisation disagrees with the objection, they must explain their reasoning and people’s right to complain to a supervisory authority (e.g., Information Commissioner’s Office in the UK).

When The Right to Object Does Not Apply

Schedule 2 of the Act summarises the grounds on which you can refuse to comply with the right to object. The most relevant of these are:

• Complying with the right would restrict freedom of speech and expression.
• When the data are processed for scientific, statistical or historical purposes.
• Where the data are being archived in the public interest.
• Where not processing the data would put the data subject or any other person at risk of serious harm in the opinion of an appropriately qualified professional.

Also if you are part of an organisation that is covered by the Freedom of Information Act then personal information is not disclosable if doing so would contravene the person’s objection to the processing of their data.

In these circumstances the right to object is not absolute. If you can demonstrate a compelling reason to override the individual’s objections then you can do so. Also, you can continue to process someone’s data for the purposes of establishing or maintaining defence from/initiating legal claims.

The Right to Object and Children

As with all rights children of any age may exercise them. This means, as we have advised before, your explanation of this right must be made in a way that a child would understand and you should not put barriers to exercising rights in place that a child could not overcome. For example, you can refuse to comply when requests are unreasonable but the fact that a child is making the request is not in itself evidence of a lack of reason.

In essence this right operates in the same way for children as it does for adults except that care needs to be taken around understanding and the capacity to understand, and that the right may be exercised by someone acting on the child’s behalf e.g. parents.

Top tips

• You must inform people of the right to object to processing when you first obtain or use their data. Therefore you need at a minimum to include this in your privacy statement.
• The right to object is absolute when data are used for marketing
• You can if you need to take reasonable steps to verify the identity of the person objecting. The 21 day compliance period starts only when you have received appropriate assurances.
• If you do decide not to comply with someone’s objection to the processing of their personal data, you must be able to identify a clear, defensible reason for doing so.
• Stopping processing data in compliance with this right does not mean you must also erase it.
• Children can exercise this right just as adults can. Therefore your information for people must (if you process children’s data) be in a form children can understand.

Learn More About the GDPR

Gain the skills and confidence you need to navigate people’s GDPR rights. These five star rated, expert led courses cover GDPR from start to finish. Because they’re available in person, online and in house, there is the perfect learning solution available for anyone who needs to understand data protection