The right to object
Unlock This Video Now for FREE
This video is normally available to paying customers.
You may unlock this video for FREE. Enter your email address for instant access AND to receive ongoing updates and special discounts related to this topic.
All individuals have the right to object under the GDPR. This right is absolute when they object to their data being used for direct marketing. This objection can be made verbally or in writing and you have to respond when you receive an objection and you must respond within one month.
It is important for organisations to know how to recognise an objection and to understand what it means. A policy should be in place to make it easy and straightforward to deal with.
In some circumstances, you can refuse an objection if you have a compelling reason to do so, as long as you provide the individual concerned with the right information.
Individuals can object if the processing is for a task carried out in the public interest or for your legitimate interests or those of a third party, however, in these cases, their right is not absolute.
Where an organisation is processing the data for legitimate interests, you should consider the reasons why they have objected if they believe that your processing is causing them substantial damage or distress, for example, financial loss, this will give their objection more weight. Before deciding whether you are going to stop the processing or continue to process and refuse, you need to make sure that you have balanced the individual’s rights and freedoms with your own legitimate interest.
If you make the decision not to stop processing the personal data, you must inform the individual concerned and explain why. You must also inform them of their right to make a complaint to the ICO or another supervisory authority. Finally, you must also advise them of their ability to seek to enforce their rights through a judicial remedy. Remember, for direct marketing you cannot refuse.
If you cannot justify your grounds for continuing to process their data you don’t always have to erase all data to comply with an objection, for example, if a person objects to direct marketing, you can add their information to a suppression list to ensure that you can continue to comply with their objection.