Right to object

What it is

The right to object is the right to object at any time to the processing of your personal data in specific circumstances, obliging the controller to stop (unless it can demonstrate overriding legitimate grounds).

It is a particularly powerful right because:

• for marketing it has immediate effect;
• it shifts the burden of proof to the controller, who must show that it can continue;
• it also applies to data collected in the past.

How it differs from other rights

• Objection: “I no longer want you to process my data for this purpose”.
• Erasure: “Delete my data completely”.
• Withdrawal of consent: only applies if the processing is based on consent.

The 3 types of objection

1. Objection on legitimate grounds (Art. 21.1)

When: the processing is based on

• the controller’s legitimate interest (Art. 6.1.f GDPR), or
• a task carried out in the public interest (Art. 6.1.e GDPR).

How it works: you object, giving reasons relating to your particular situation.

Effect:

• the controller must stop processing,
• unless it demonstrates compelling legitimate grounds that override your interests and rights,
• or the processing is needed to establish, exercise or defend legal claims.

Example: an insurance company uses your data, collected for a quote, to send you commercial offers on the basis of “legitimate interest”. You object because:

• you have health problems and insurance offers cause you stress;
• you already have a policy and are not interested;
• of any other valid personal reason.

Outcome: the insurer must stop, unless it demonstrates an overriding legitimate interest (very difficult).

2. Objection to direct marketing (Art. 21.2)

When: the processing is for direct marketing (advertising, promotional newsletters, commercial profiling, telemarketing).

How it works: you object without having to give any reason.

Effect:

• immediate and unconditional;
• the controller must stop;
• no possibility of invoking overriding grounds;
• it applies both to marketing based on consent and to marketing based on legitimate interest.

It is the strongest right: absolute, with no exceptions.

Examples

• An e-commerce newsletter → you click “Unsubscribe” = objection.
• Promotional phone calls → you say “I don’t want to be contacted again” = objection.
• Targeted online advertising → you switch it off in your account settings = objection.

Important: objection also covers profiling for marketing purposes (Art. 21.3). If you object to marketing, the controller can no longer profile you for commercial purposes.

3. Objection to scientific or statistical research (Art. 21.6)

When: the processing is for scientific or historical research or statistical purposes (Art. 89.1 GDPR).

How it works: you object on grounds relating to your particular situation.

Effect:

• the controller must stop,
• unless the processing is necessary for a task carried out in the public interest.

Example: a research body uses your anonymised health data for an epidemiological study. You object because you do not want your data, even anonymised, to be used for research. The body must stop, unless it shows that the study is of significant public interest (for example research on a pandemic).