It’s important to know that you have the right to oppose the use of your personal data by organisations. This is called the “right to object.” If an organisation accepts your objection, it must stop using your data unless it has valid reasons to continue its processing.
This right is covered under Article 21 of the General Data Protection Regulation (GDPR):
“The data subject (that’s you!) shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is based on point (e) or (f) of Article 6 (1), including profiling based on those provisions.”
This guide explains how to exercise your right to object, when you can use it, and what to expect from organisations.
How Do I Exercise the Right to Object?
Before exercising the right to object, you need to understand how an organisation is using your data. You can do this by submitting a subject access request.
You can only object to the processing of your data when the organisation is using it for:
- Duties carried out in the public interest
- Legitimate interests of the organisation
- Scientific or historical research
- Direct marketing
Once you understand how your data is being used, you can determine whether you can object. If you can, you should inform the organisation that you object to any further processing of your data and explain why you believe it should stop using it.
You can make your right to object request in any format—verbal, in writing, via social media, or by using tools like Tapmydata (this function will be introduced later in 2019).
If you make the request verbally, it’s advisable to follow up in writing. This provides proof of your request in case you need to challenge the organisation later.
Organisations cannot charge you for making a right to object request unless it is deemed unreasonable or excessive. (The definition of these terms is still being debated!)
Use a Tool to Make It Easier
We created Tapmydata to help you easily exercise your data rights. The app is free, available on both Apple and Android, and we don’t collect or store your personal data.
What If I’m Not Satisfied with the Response?
If you’re unhappy with how the organisation has handled your request, the first step is to complain directly to them. Contact their data protection officer or customer support team, which you can typically find on their website or in their privacy policy.
If you’re still dissatisfied, you can escalate the issue by filing a complaint with the Information Commissioner’s Office (ICO).
How Should I Raise My Concern About the Organisation’s Use of My Personal Data?
To raise your concern, you can send your request in any format—verbal, in writing, or using the Tapmydata tool. Be sure to specify what aspect of the data processing you are objecting to, so the organisation knows exactly what action to take.
What Should Organisations Do?
If your objection is valid, the organisation must stop processing your personal data for the specific purpose you objected to. However, in some cases, the organisation may still be able to use your data for other purposes.
Does the Organisation Have to Stop Using My Personal Data?
Yes, if your objection is valid. However, the organisation can refuse your objection if it has a compelling reason to continue processing your data. It can also refuse if your request is deemed “manifestly unfounded or excessive.”
In such cases, the organisation may:
- Request a reasonable fee to handle the request.
- Refuse to process your objection.
If either of these occurs, the organisation must explain its decision to you.
When Should I Get a Response?
The organisation is required to respond to your objection within one month. If they need more time to consider your request, they can take up to two additional months. If this happens, the organisation must inform you within the first month, explaining why they need more time.