Article 21 of the GDPR
The Right to Object to processing of personal data
A data subject has the right to object to a company’s processing of the data subject’s personal data. In some cases, there is an absolute obligation for companies to cease processing if the data subject objects. However, in certain situations, the company may have the right to continue the processing despite the received objection.
The Right to Object to processing of personal data
Article 21 of the GDPR governs the data subject’s right to object to processing of personal data. This right is one of the eight fundamental rights that data subjects have under the GDPR.
A data subject has the right to object to processing of his or her personal data in certain situations. Below is a description of these:
- Public interest: If the company processes the personal data for the performance of a task carried out in the public interest.
- Exercise of official authority: Where the controller conducts the processing in the exercise of official authority. For example, if the company processes the personal data to perform a task as part of the exercise of public authority.
- Legitimate interest: When a company processes personal data on the legal basis legitimate interest. In particular, in the following cases:
- Direct marketing: If a company processes personal data for direct marketing purposes. For example, email addresses of previous customers in order to send offers.
- Scientific or historical research purposes: Whether the purpose of the processing is scientific or historical.
- Statistical purposes: When a company processes personal data for statistical purposes.
A Company did not cease direct marketing after data subjects objected
A company in Sweden carried out direct marketing via email. Some data subjects raised an objection to the processing of their personal data by the company for this purpose. The data subjects wanted the company to stop direct marketing to them. The company had not taken sufficient technical and organisational measures to comply with that right. Despite the data subjects objections, the company continued to send newsletters with direct marketing to the data subjects. Therefore, the company had to pay a fine of SEK 350,000 according to the Swedish Authority for Privacy Protection.
The company may in some cases have the right to continue the processing despite an objection
In the following situations, a company may continue processing, even if the data subject objects to it:
Establishment, defence or settlement of legal claims
In some cases, the company may need to continue processing personal data when it is necessary for, for example, the establishment, defence or settlement of legal claims. In such cases, the processing is permitted if it is necessary for these purposes, despite the data subject objecting to the processing. The company shall inform the data subject if the company continues the processing after an objection. In addition, the company must inform the data subject of all other fundamental rights that the data subject has under the GDPR. Such as the right of access to personal data and the right to rectification of personal data.
Re-examination of the legitimate interest by means of a new balancing of interests
A company may process personal data after a balancing of interests, based on legitimate interest as a legal basis. In the event of an objection to such personal data processing, the company may review the legitimate interest and make a new assessment.The purpose of the review is to see if there are compelling legitimate reasons why the company must continue the processing of the personal data, despite the objection. In the new assessment, the company could conclude that the company has a decisive legitimate interest in the processing. That is, the interests of the company are legitimate and outweigh the interests, rights and freedoms of the data subject. In such cases, the company has the right to continue the processing, even if the data subject has invoked his or her right to object to processing. Please note that this does not apply to the processing of personal data that takes place specifically for direct marketing purposes. The data subject has an absolute right to object to such processing, at any time. If an objection is raised against direct marketing, the company may no longer process the personal data for that purpose. In this case, the processing of personal data for that purpose shall cease.
The company can sometimes refuse a request
A company has the right to verify the identity of a data subject who wishes to invoke a right, such as the right to object to processing. In addition, according to the general rule, the company must comply with the request free of charge.
However, in some cases, the company may refuse the data subject’s request to exercise his or her rights. This applies if the request is manifestly unfounded or unreasonable. For example, if the data subject repeatedly requests the same thing. In such cases, the company shall inform the data subject of the reasons for the decision to refuse the request. In some cases, the company may also be allowed to charge a fee that is reasonable to fulfil the right, instead of refusing to comply with the request.
Other data subjects' rights under the GDPR
Right to data portability
Companies should facilitate the transfer of personal data to other companies in certain cases. For example, if a company operates a social media service and the data subject wishes to transfer their personal data to another social media service. Please note that this only applies if the legal basis is consent or contracts with data subjects.