The seventh data protection right is the right to object. Similar to the previous rights of erasure and restriction, people can stop or prevent organisations from processing their data. The objection may apply to all, or just some, of their data.

When does the right to object apply?

If the data is collected or processed for direct marketing purposes, people have an absolute right to object, as there are no possible exemptions. You must suppress their details, only keeping enough data to ensure that they don’t receive direct marketing in the future.

If the data is for public task or legitimate interest, they must provide situation-specific reasons for their objection. You can override their request if the data is to establish, exercise or defend legal claims, or your legitimate interests override their individual rights.

What do we need to do?

When you first contact the person, such as providing the initial privacy notice, you must also inform them of their right to object, if you are processing for direct marketing, public task, or legitimate interest.

If you decide to refuse the request, you must inform them why you are refusing, of their right to complain to a supervisory authority (such as the ICO), and their ability to legally fight for this right.

If the objection is valid, and not manifestly unfounded or excessive, you must respond as soon as possible, and within a month. You must stop processing the relevant data, and may have to erase parts of it.

If you need any more information regarding the right to object, how to apply the objection, or other advice on dealing with data privacy rights, feel free to contact us.

Next week will be the final post in our Data Protection Rights series, covering automated processing.