Get Free Downloads
Start your GDPR today in just a few clicks
      
Get Free Downloads
Start your GDPR today in just a few clicks

GDPR Right To Object

Tagged with GDPR HELP, GDPR ADVICE, GDPR, RIGHT TO OBJECT
by Adam Brogden
in Blog

20-Jun-2019 11:16

The Right to Object is one of the fundamental rights of a data subject in GDPR and is defined in Article 21. It sounds pretty obvious, giving the subject the right to tell you to stop processing. However this is not quite the case. The Right to Object is not an absolute right and in many cases you do not have to simply stop processing.

How you interpret these requests depends very much on your lawful basis. Different lawful basis determine how you need to respond. Take a look at the following from the ICO:

____________________________________________________________________

The GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.

  • Individuals have an absolute right to stop their data being used for direct marketing.

  • In other cases where the right to object applies you may be able to continue processing if you can show that you have a compelling reason for doing so.

  • You must tell individuals about their right to object.

  • An individual can make an objection verbally or in writing.

  • You have one calendar month to respond to an objection.

Individuals can also object if the processing is for:

  • A task carried out in the public interest;

  • The exercise of official authority vested in you; or

  • Your legitimate interests (or those of a third party).

In these circumstances the right to object is not absolute.

An individual can also object where you are relying on one of the following lawful bases:

  • ‘public task’ (for the performance of a task carried out in the public interest),

  • ‘public task’ (for the exercise of official authority vested in you), or

  • legitimate interests.

An individual must give specific reasons why they are objecting to the processing of their data. These reasons should be based upon their particular situation.

In these circumstances this is not an absolute right, and you can continue processing if:

  • you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or

  • the processing is for the establishment, exercise or defence of legal claims.

If you are deciding whether you have compelling legitimate grounds which override the interests of an individual, you should consider the reasons why they have objected to the processing of their data. In particular, if an individual objects on the grounds that the processing is causing them substantial damage or distress (eg the processing is causing them financial loss), the grounds for their objection will have more weight. In making a decision on this, you need to balance the individual’s interests, rights and freedoms with your own legitimate grounds. During this process, you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of the individual.

If you are satisfied that you do not need to stop processing the personal data in question you should let the individual know. You should explain your decision, and inform them of their right to make a complaint to the ICO or another supervisory authority; and their ability to seek to enforce their rights through a judicial remedy.

The GDPR is clear that you must inform individuals of their right to object at the latest at the time of your first communication with them where:

  • you process personal data for direct marketing purposes, or

  • your lawful basis for processing is:
    • public task (for the performance of a task carried out in the public interest),

    • public task (for the exercise of official authority vested in you), or

    • legitimate interests.

If one of these conditions applies, you should explicitly bring the right to object to the individual’s attention. You should present this information clearly and separately from any other information.

If you are processing personal data for research or statistical purposes you should include information about the right to object (along with information about the other rights of the individual) in your privacy notice.

________________________________________________________________________

This is a tricky area. Please call us to discuss.

Good luck all.