The right to object to processing of personal data (Article 21 of the GDPR)
When do you have a right to object?
You have the right to object to certain types of processing of your personal data where this processing is carried out in connection with tasks:
- in the public interest,
- under official authority,or
- in the legitimate interests of others.
You have a stronger right to object to processing of your personal data where the processing relates to direct marketing. Where a data controller is using your personal data for the purpose of marketing something directly to you, or profiling you for direct marketing purposes, you can object at any time, and the data controller must stop processing as soon as they receive your objection.
You may also object to processing of your personal data for research purposes, unless the processing is necessary for the performance of a task carried out in the public interest.
How do you object to processing?
In order to object to processing, you must contact the data controller and state the grounds for your objection. These grounds must relate to your particular situation. Where you have made a valid objection, the data controller must cease processing your personal data, unless the data controller can provide compelling legitimate reasons to continue processing your data. Data controllers can also lawfully continue to process your personal data if it is necessary for certain types of legal claims.
What obligations do data controllers have in relation to this right?
Where the right to object applies, data controllers are obliged to notify you of this at the time of their first communication with you. Where processing is carried out online, data controllers must offer an online method to object.
Your rights in relation to automated decision making, including profiling (Article 22 of the GDPR)
You have the right to not be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects you.
Automated processing includes profiling.
In respect of personal data, when is automated processing permitted?
Automated processing is permitted only with your express consent, when necessary for the performance of a contract or when authorised by Union or Member State law. Where one of these exceptions applies, suitable measures must be in place to safeguard your rights, freedoms and legitimate interests. This may include the right to obtain human intervention on the controller’s part, the right to present your point of view and the right to challenge the decision.
In respect of special category personal data (‘sensitive’), when is automated processing permitted?
Where automated processing relates to the special categories of personal data (outlined in the key definitions above), processing is only lawful where you have given your express consent to the processing, or where it is necessary for reasons of substantial public interest.