The Right to Restrict Processing: GDPR rights explained

The Right to Restrict Processing is one of people’s rights to control their data under GDPR. It is perhaps one of the most complex. This is for two reasons:

• like many rights it only applies in certain circumstances
• in many ways this right exists to help people facilitate their other rights

As part of this article we will think primarily about how this right applies to and can be exercised by children. This can make navigating this right more difficult.

As the name suggests, people can exercise this right if they have an objection to the use of their data. This can be for any reason. For example, if they feel their data are inaccurate, they want you to delete their data, or they want you to stop processing it for a particular activity (the Right to Object, covered later) then they can also ask you to restrict the processing of their data while you consider their request. Someone may also ask you to restrict the processing of their data but not to delete it.

Your Legal Duties

Under Section 99 (3) of the Data Protection Act 2018 if someone exercises their right to restrict processing of their data you have to comply, or explain that you will not comply, within 21 days. However, given the heavily automated or computerisation of data AND your duty to understand your data processing activity you should be able to comply much faster than that.If you cannot meet the timescale or you decide not to restrict processing, the person can apply for a court order .

In essence the Right to Restrict Processing is a temporary suspension or pause in one or more data processing activities. Examples include:

• Removing someone from a marketing or mailing list
• Withdrawing information about someone that has been published on your website or social media accounts (including photos)
• Not including someone’s data in a data set available to some staff or colleagues

Remember you will be doing this while you are reviewing how to comply with the other right(s) people are exercising. This means such restrictions will also be temporary. It is important to ensure that when it is time to start processing the data again, you tell the person concerned that the restrictions on processing are being lifted.

When Can People Exercise the Right to Restrict Processing?

People can restrict the processing of their data in four main scenarios:

1. Contesting Accuracy: someone may believes the data an organisation holds about them is inaccurate. If so, they can request restriction while they verify its correctness. People have the right to challenge the accuracy and request rectification if necessary. Restriction prevents an organisation from using the data for other purposes until the issue is resolved.
2. Unlawful Processing: If people believe the processing of their data is unlawful (e.g., not based on valid consent), they can request restriction instead of erasure. This prevents data controllers and processes from further processing data. In the meantime people can decide whether to pursue erasure or challenge the processing through legal means.
3. No Longer Needed: If the organisation no longer needs personal data for the original purpose it was collected for, but they need to keep it it for legal purposes (e.g., evidence in a court case), people can request restrictions on processing. This prevents organisations from deleting the data but restricts its use for other purposes.
4. Objection to Processing: You have the right to object to processing based on your specific situation, even if it’s considered lawful. If you object, you can exercise your right to restrict processing while the organisation assesses your objection and determines whether to continue processing your data.

Limits on the Right to Restrict Processing

There are some circumstances when you can refuse to restrict processing but these are limited. Generally they include:

• you have the individual’s consent;
• it is for the establishment, exercise or defence of legal claims;
• when it is for the protection of the rights of another person or other legal entity;
• it is for reasons of important public interest;
• where the request is manifestly excessive or unreasonable.

When it comes to children it is important to remember that people of any age can exercise their rights. It may be appropriate to automatically restrict the processing of their data whether they have asked you to or not. It is likely that you will have to take care deciding where the right balance between their wishes and your data processing needs lie. Also you must communicate your decisions in ways the child would understand.

The balancing act comes not only because children might find it harder to understand the consequences of decisions about their data. Children by definition mature as they get older and their priorities and views change. They may therefore be quicker to withdraw consent for the use of their data, or to object to the publication of data about them.

In addition they are, perhaps ironically, better informed about social media and how they work than older people so can have a better understanding of the impact of putting data in the public domain via these routes.

By restricting the processing of data when you can you will be giving yourself a breathing space. You can use it to make the best possible decision. Importantly, you will also be demonstrating compliance with the GDPR by recognising the importance of taking extra care when children are involved.

Top tips:

• Make sure you have a comprehensive record of processing activity.
• Establish procedures that ensures decisions about restricting processing activity are made and actioned as quickly as possible.
• Consider automatically stopping processing data when a child is exercising their rights.
• As and when you decide to lift the restriction make sure you tell the person concerned before data processing resumes.
• If you process the data of a child you must explain this, and their rights, in a way the child would understand.