Objections to processing
The GDPR includes similar provisions to those of the existing legislation in respect of objections to processing.
The existing right to object to processing for direct marketing purposes remains (Article 21) but is enhanced to include:
- any profiling in connection with direct marketing
- the obligation to provide enhanced fair processing information.
The existing right to object to automated decision-making remain (Article 22), but are enhanced to include;
- objections in respect of the use of profiling to make automated decisions concerning them.
There is a new right to object at any time to processing that relates to their particular situation, including profiling, even when it is lawfully carried out on the grounds of tasks carried out in the public interest with official authority or the legitimate interests of the data controller. (Article 21(1))
If such an objection is made, processing cannot continue until the controller "demonstrates compelling, legitimate grounds ... which override the interests of the rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims".
This places the onus on controllers to demonstrate that processing is lawful and necessary and will engage the new accountability requirements, such as keeping records of processing activities.