Objections to processing

There are two circumstances where the right to object to processing can be exercised:

1. An absolute right to object to processing for the purposes of direct marketing (Articles 21(2) & (3) of the Applied GDPR)
2. A qualified general right in specified circumstances (Articles 21(1) & (6) of the Applied GDPR)

1. Absolute right to object to processing for direct marketing purposes

This right applies to ANY form of marketing and also applies to profiling of individuals undertaken in respect of direct marketing activities. Controllers should note that whilst there continue to be additional specific rules relating to electronic direct marketing (the Unsolicited Communications Regulations 2005), these are not covered on this page.

The right must be explicitly brought to the attention of individuals clearly and separately from any other information at the latest at the time of the first communication.

2. Qualified general right in specified circumstances

Individuals have the right to object to all, or particular, elements of processing, such as disclosures to certain parties, including for profiling purposes, where the processing is necessary for one of two specific grounds:

• The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

In the case of public interest tasks etc., these are discretionary exercises of official authority, or implied powers, and is of particular relevance to the public sector.

The legitimate interest ground for processing only applies in the private sector. 

In either case, controllers must make a specific consideration of the processing of that individual’s personal data in the context of their particular circumstances.  It cannot be a generalised deliberation. 

The controller cannot process the relevant personal data until it has demonstrated “compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims”.  

Restrictions on the right

The right to object to processing can be restricted where "such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society". The controller must be able to demonstrate that any restriction imposed is necessary in the circumstances.

The restrictions and exemptions are set out in Schedule 9 of the Implementing Regulations.  

Non-compliance with requests to exercise rights

If the controller is not taking action on the request of the individual to exercise any right, it must inform the individual “without delay” (and within ONE month of receipt of the request) about:

• the reasons for not taking action; and
• their remedies, in particular the right to lodge a complaint with a supervisory authority and to seek a judicial remedy.