Know your rights. It’s your right to oppose organisations using your personal data. This is called the right to object. If the organisation understands and accepts your objection, it must stop using your data unless it has valid reasons to continue using your data.
This right is covered in Article 21 of the GDPR, as follows:
“The data subject (that’s you!) shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6 (1), including profiling based on those provisions.”
This guide will show you how to exercise your right to object, under what circumstances you can exercise this right and what to expect from organisations.
How do I exercise the right to object?
Before you exercise the right to object you need to ask and understand how an organisation is processing your data. You can do this by sending them a subject access request.
You can only object to processing when the organisation is using your data:
- Duties carried out in the public interest
- For its legitimate interests
- Scientific or historical research
- Direct marketing
How the organisation is processing your personal data will show whether or not you can object.
If you can object, you should let the organisation know that you object to any more processing of your data. You will need state in your objection why you believe the organisation should stop using your data.
You can send a right to object request in any format. A request can be verbal, in writing, via social media or by using a free tool such as Tapmydata (please note we will be introducing this specific function later in 2019).
If you make a request verbally we recommend that you follow up in writing because doing so gives you proof of your actions should you need to challenge that organisation at a later date.
An organisation cannot charge you for making such requests, unless they are deemed unreasonable or excessive (the jury’s currently out on how these are defined!).
Use a tool, make life easier
I am not happy with the response, what can I do?
If you are still unsatisfied, you can make a complaint to the Information Commisioner’s Office (ICO).
How should I raise my concern about how an organisation has handled my personal data?
You can raise your concern by sending a request in any format. A request can be verbal, in writing or using our free tool Tapmydata.
Remember you should outline in your request what it is you are objecting to, so the organisation can take the necessary steps to stop processing your personal data.
What should organisations do?
If your objection is successful the organisation must stop processing your personal data for the use you have objected to. In some circumstances the organisation may still be able to continue using your data for other purposes. See below.
Does the organisation have to stop using my personal data?
Yes. However, the organisation can refuse your objection if it has a strong reason to continue processing your data. The organisation can also refuse your objection if the request is “manifestly unfounded or excessive”. Remember though, the organisation should inform you of this outcome.
In such circumstances the organisation can:
- Request a reasonable fee to deal with the request, or
- Refuse to deal with the objection
In either eventuality the organisation must tell you and justify its decision.
When should I get a response?
The organisation has one month to respond to your objection. In certain circumstances it may need extra time to consider it and can take up to an extra two months. If it is going to do this, it should let you know within one month that it needs more time and why.
Will it cost me anything?
Generally, no! Organisations can only charge a fee if the request is as the law states “manifestly unfounded or excessive”. The organisation then may be able to ask for a fee for admin costs associated with your request.
We hope you found this guide useful. Check out our free tool to help you exercise your data rights, beginning with the Right to Access. And go to the My Data Rights section of our blog to find more data rights and how to exercise them.