Handling Right to Object to Processing

Overview

The right to object under GDPR Article 21(1) allows data subjects to object to processing based on legitimate interests (Art. 6(1)(f)) or public interest/official authority (Art. 6(1)(e)), including profiling based on those provisions. Upon objection, the controller must cease processing unless it demonstrates compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or processing is necessary for legal claims.

Legal Foundation

GDPR Article 21 — Right to Object

1. Art. 21(1) — The data subject has the right to object, on grounds relating to their particular situation, to processing based on Art. 6(1)(e) (public interest) or Art. 6(1)(f) (legitimate interests), including profiling based on those provisions. The controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defence of legal claims.

2. Art. 21(2)-(3) — [Covered separately in managing-direct-marketing-objection skill]

3. Art. 21(4) — At the latest at the time of the first communication with the data subject, the right to object shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

4. Art. 21(5) — In the context of the use of information society services, the data subject may exercise their right to object by automated means using technical specifications.

5. Art. 21(6) — Where personal data are processed for scientific or historical research purposes or statistical purposes under Art. 89(1), the data subject has the right to object unless the processing is necessary for the performance of a task carried out for reasons of public interest.