Portability and objection are often lumped together as the “other rights”. They work very differently, and each has a trap.
Portability: narrow by design
The right to data portability lets a person receive data they provided, in a structured, commonly used and machine-readable format, and have it sent directly to another controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. where that is technically feasible. It applies only where:
- the processing is based on consent or a contract, and
- it is carried out by automated means.
It does not apply to processing under public task or legal obligation, and it covers data the person provided, which includes data observed from their use of a service, such as activity logs, but not inferences you derived from it.
The trap is over-reading it. Portability is not a general right to a copy of everything; that is subject access. And a portability request does not by itself require erasure.
Protect other people: if a dataset contains third parties’ data, such as a shared account or contacts list, consider what the receiving controller would do with it.
Objection: two different rights
Objection to direct marketing is absolute. If a person objects to processing for direct marketing, including profilingProfilingAutomated processing to evaluate personal aspects of someone, such as performance, finances, health or behaviour. Automated decisions are now governed by UK GDPR Arts 22A to 22D. for it, you must stop. There is no balancing test and no exception. Keep them on a suppression list so it sticks.
Objection to other processing is qualified. Where you rely on public task or legitimate interests, a person can object on grounds relating to their particular situation. You must stop unless you can show compelling legitimate grounds that override their interests, rights and freedoms, or the processing is for legal claims. The burden is on you.
The right to object must be brought to people’s attention explicitly and separately, at the latest at the first communication.
PECR sits on top
For electronic marketing, PECR applies whatever the UK GDPR says. Every marketing email or text must give a simple means of refusing, and live calls must be screened against the Telephone Preference Service and your own do-not-call list. An objection under Article 21 and an opt-out under PECR should feed the same suppression list.
Timing
Both rights follow the one-month response rule, extendable by two months for complexity or volume. But an objection to direct marketing should take effect as fast as your systems allow; continuing to market for a month after “stop” is an obvious complaint.
For a complaint
For marketing, say only “I object to direct marketing” and the date. No reason is needed and none can be required. For other processing, explain your particular situation: that is the material the organisation has to weigh.