What is the right to object, and is it absolute?

What it is

You must tell people about the right to object clearly and separately, at the latest at your first communication. For direct marketing, the objection covers profiling related to it. For research, the right is limited where the processing is necessary for a public interest task.

When it applies

• Processing based on public task or legitimate interests: stop unless you have compelling grounds or need it for legal claims. UK GDPR Art 21(1)
• Direct marketing, including related profiling: stop, always. Art 21(2)-(3)
• Research and statistics, unless necessary for a task carried out in the public interest. Art 21(6)

Who is responsible

The controller. For marketing, also screen against suppression lists so the objection sticks.

What it involves

1. Identify the basis for the processing objected to.
2. For marketing, stop and suppress at once.
3. Otherwise weigh compelling grounds and record the decision.
4. Respond within one month.

Timing

One month for non-marketing objections; marketing objections take effect immediately.

If it goes wrong

Regulatory

Failing to respond properly breaches Arts 12 to 22. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Most cases start with a complaint to the regulator, which can order compliance. Continuing to send marketing after an objection also breaches PECR.

Criminal

No offence.

Civil

The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).