PL EN
Book a meeting
Chapter 2Data Subject’s Rights
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 2.9
  1. 2.1Processing Data Subject’s Rights and Requests (Article 12 of the GDPR)
  2. 2.2Right to Be Informed and Privacy Information Obligation (Articles 13 and 14 GDPR)
  3. 2.3Right of Access to Data and to a Copy of Data (Article 15 GDPR)
  4. 2.4Right to Rectification of Data (Article 16 GDPR)
  5. 2.5The Right to Erasure (Right to Be Forgotten) (Article 17 GDPR)
  6. 2.6Right to Restriction of Processing (Article 18 GDPR)
  7. 2.7Obligation to Notify about Rectifying, Erasing, or Restricting of Processing of Data (Article 19 GDPR)
  8. 2.8Right to Data Portability, i.e. How to Transfer Data from One Controller to Another (Article 20 GDPR)
  9. 2.9The Right to Object (Article 21 GDPR)
  10. 2.10Profiling and Automated Decision-Making (Article 22 GDPR)

The Right to Object (Article 21 GDPR)

Aleksander P. Czarnowski, Katarzyna Kunda, Maciej Gawronski, Michał Kibil, Michał Sztaberek & Paweł Punda

#9.1 The Right to Object

GDPR provides that a person may object to the processing of his or her data by a controller. An effective objection to data processing should result in the data covered by the objection no longer being processed.

But we cannot object to the processing of our personal data in every situation.

There are two types of objection:

  1. 1)an objection due to one’s particular situation, or
  2. 2)an objection against direct marketing (an objection ‘at will’, since it requires neither a justification nor conditions of effectiveness).

Upon receiving an objection based on a particular situation, a controller should no longer process the data, unless it can show that:

  1. 1)compelling legitimate grounds exist for the processing that override the interests, rights, and freedoms of the data subject, or
  2. 2)grounds exist for establishing, pursuing (exercising), or defending claims, or
  3. 3)the processing is necessary in order to perform duties in the public interest – if the objection refers to processing for the purposes of scientific or historical research, or for statistical purposes (pursuant to Article 89(1) GDPR).

If an objection refers to direct marketing, the controller must simply cease the processing covered by the objection.

If, however, what the objection concerns is unknown, then, based on Article 12 GDPR, the controller is obliged to facilitate the person’s right to object. The controller has no right to ignore an objection that has been expressed incompletely. The controller must ask the data subject exactly what he or she is objecting to and what the justification is. The right to object is always contextual – in order to determine the basis and scope of an objection, the circumstances associated with it must be specified.

If a controller receives an objection and wants to continue running its business in peace with the minimum effort, it should comply with the objection and document this (the principle of accountability).

Alternatively, the controller may begin proceedings to assess the justifiability of the objection and the grounds for complying with it.

#9.2 Objecting Due to a Particular Situation of the Data Subject

Depending on a person’s particular situation, he or she may object to the processing of data when that processing is based mainly on the following legal grounds:

  1. 1)a justified interest of the data controller,
  2. 2)the public interest or interest of public authorities,
  3. 3)scientific or historical research purposes, or statistical purposes, pursuant to Article 89(1) GDPR.

What constitutes a ‘particular situation’ is any factual circumstances which differ from the situation of other people whose data are being processed. An example is a threat to the personal safety of a particular person or a state of grief or even a mental health condition. It is also vital that the particular situation affects the data processing such that there is an imbalance between the interests of the data subject and the data controller.

In principle, whether a particular situation exists should be determined individually. In reality, it will normally be an extraordinary situation of a person that differs from the general group of people ‘processed’ by the controller. But it need not always be so, especially when the processing itself is exceptional. It will then be a simple matter of weighing the particular circumstances of the data subject against the interest of the controller (or a third party).

A particular situation will also depend on the processing context – the purpose of the processing and the interest of the controller (or third party) the processing serves.

A controller can dismiss an objection that does not concern direct marketing if it can show the existence of:

  1. 1)compelling legitimate grounds exist for the processing that override the interests, rights, and freedoms of the data subject, or
  2. 2)grounds exist for establishing, exercising, or defending claims.

#9.2.1 Compelling Legitimate Grounds

In accordance with what is set out in Recital 69, as well as in light of the principle of accountability, it is up to the controller to prove that it (or a third party) has a compelling legitimate ground for processing that overrides the interests or basic rights and freedoms of the data subject.

If the personal data processing is based on a justified interest (as indicated in Article 6(1)(f) GDPR), then even at the initial stage (before the data processing begins) the data controller should weigh the interests of the data subject against its own (or those of another entity in whose interest it intends to process the data). An objection also requires that such interests be weighed, but here this takes place in a situation where the controller has already collected the data and is processing them on an ongoing basis and only then does the data subject file an objection; the weighting of interests, therefore, is done individually.

#9.2.2 Claims and Disputes

The second basis for refusing to comply with an objection would seem to be quite obvious. The EU legislator stipulated that processing may take place in spite of an objection if grounds exist for establishing, pursuing, or defending claims. In truth, the GDPR does not specify what claims this concerns, but, taking account of the general prohibition on destroying evidence, it must concern claims by anyone – as long as the controller is able to show that the personal data concerned are genuinely needed for the purposes of pursuing a specific claim.

When determining whether there is an exception that permits data processing despite an objection, remember that this also is contextual – that is, it must be seen in the context of the purpose. It is permissible to process data despite an objection if the data are needed to process a claim, but then they can be processed only for the purposes of the claim, and not, e.g., for direct marketing purposes.

#9.2.3 The Public Interest or Interest of Public Authorities

The general regulation on data protection also permits objections to the processing of data based on a person’s particular situation when the processing is based on the public interest or the interest of a public authority. Since such an exception exists, it must mean that it is not enough for a controller to simply say that a public interest or interest of a public authority exists in order to dismiss an objection. The controller must either show that the objection to processing is not grounded because the personal situation of a data subject is not so peculiar or that the public interest or need to exercise public authority outweighs the specific situation of the person objecting to the processing. Such assessments are very fluid, and one can expect that ‘public’ controllers will tend to overrule objections. This does not mean, though, that we should immediately condemn such a tendency, since within certain limits the public interest usually does override individual interests, and public authority is also exercised in the public interest.

A somewhat similar situation also occurs in the context of the right to object when data are processed for the purposes of scientific or historical research, or for statistical purposes pursuant to Article 89(1) GDPR. Here as well, an applicant must show his or her particular situation, but the data controller may refuse to comply with the demand to cease processing if the processing is necessary in order to carry out a duty in the public interest.

#9.3 Data Processing for the Needs of Direct Marketing

Where data are being processed for the needs of direct marketing, the data controller must simply comply with an objection from a data subject.

Filing an objection to the processing of data for direct marketing purposes is not the same as the deletion of data. The controller will still be able to process the data – but only for other purposes, e.g., in relation to conducting mandatory financial reporting.

#9.3.1 Objection to Direct Marketing and Withdrawal of Consent to Processing

Functionally, an objection to direct marketing directly corresponds to a withdrawal of consent to processing. In both cases, no conditions need to be stated in order to eliminate the basis for processing. For example, the supervisory authority in Great Britain (the Information Commissioner’s Office) lists a marketing objection alongside a withdrawal of consent.

#9.3.2 Objection to Direct Marketing and Consent to Remote Marketing Communications

The law makes it difficult to understand the rules governing direct marketing because it regulates the issue of the right to process data for direct marketing purposes separately from the issue of the permissibility of contacting a person for direct marketing purposes. Pursuant to the GDPR (unchanged in relation to the old provisions), direct marketing is deemed to be a justifiable legal interest of a data controller constituting grounds for data processing. Hence, the GDPR does not require consent to data processing for direct marketing purposes; it only makes it possible to object to that activity (an opt-out approach). Except that the E-Privacy Directive requires prior consent to the use of electronic or telephone communication for direct marketing purposes. The EU is planning to regulate this issue in a uniform manner in an e-privacy regulation, which is currently on its way through the EU legislative process.

#9.4 Effective Submission of an Objection to Data Processing

As already indicated, when faced with an objection to processing data for direct marketing purposes, a controller is obliged to comply with the demand. The same applies in other cases, provided there are no circumstances that permit the controller to dismiss the objection.

Of course, one can imagine a situation in which a data controller decides that the data subject is not in a particular situation that justifies their exercising the right to object. Such a case may then be considered by the supervisory authority (on the basis of a complaint by the data subject), which may order compliance with the objection (see Article 58(2)(c) GDPR, where the authorisation granted by the EU legislator to supervisory authorities includes that of ordering a data controller to comply with demands by data subjects that result from the rights they enjoy under the GDPR).

#9.5 How an Objection Should Be Submitted

In theory, a data subject can exercise their right to object in any form, provided it is authenticated other than verbally (Article 12(1) GDPR). An objection may be articulated in a written email or a phone conversation (during which a PIN electronic authentication is used), etc. This interpretation is supported by the content of Recital 59 GDPR, in which it is stated that a data controller implements procedures that make it easier for data subjects to exercise their rights under the GDPR, including the right to object. A controller should ensure that it is also possible to submit demands electronically, particularly if the personal data are processed electronically.

In practice, apart from the need to authenticate, the accountability requirements also mean that objections must be documented at some stage. If an objection is submitted by phone or face-to-face at a branch, the controller’s personnel must document the situation, e.g., by immediately sending an email describing the content of the demand to the data subject, getting a data subject to sign an objection form, etc. In this way, both the demand itself and the date and time it was submitted are recorded in order to meet the service level requirements (response time) contained in Article 12 GDPR.