In today’s technology-driven world, the digital landscape has rapidly transformed, resulting in increased data collection by various organizations from individuals. Consequently, it is imperative to raise awareness and educate individuals about their rights when disclosing personal data.
One of such rights is the right to object to data processing and it plays a crucial role in ensuring individuals have control over their personal information and how it is used. This right empowers individuals to voice their concerns or preferences regarding the processing of their data, providing them with a vital tool to protect their privacy and exercise their autonomy. By exercising this right, individuals can object to the processing of their data for direct marketing purposes, profiling, or other circumstances where they believe their fundamental rights and freedoms are at risk.
Highlight on Data Subject Rights
Data subject rights are the rights that individuals have over their personal data. These rights are granted to them by data protection laws, such as the General Data Protection Regulation (GDPR). For example, a person’s name, signature, address, phone number, date of birth, etc.
The GDPR may aimed at data controllers (and businesses), but data subjects that are truly at the core of the text. All the rules, restrictions, and requirements placed in the GDPR share the aim of protecting data subjects (or users) and upholding their rights.
Chapter 3 of the GDPR records those rights as the Rights of the Data Subject and outlines distinct rights that all Europeans are entitled to and that your organization must uphold through your data practices. The eight user rights are:
- The Right to Information
- The Right of Access
- The Right to Rectification
- The Right to Erasure
- The Right to Restriction of Processing
- The Right to Data Portability
- The Right to Object
- The Right to Avoid Automated Decision-Making
The Right to Object
Article 21 of the European GDPR outlines what is known as the right to object. In simple terms, it says that data subjects have the right to object to your data processing, including profiling, when it is on relevant grounds.
“The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise or defence of legal claims.”
In the case of a data controller who engages in direct marketing, Article 21(2) says the data subject can object at any time when the processing you do relates to direct marketing, and you must comply. For example, if a data subject unsubscribes from your marketing emails, you must not send them any more emails until and unless they provide consent for you to do so.
It is important that individuals must be adequately informed of their legal right to object at first communication, such communication must be clear and separate from any other information to enable the withdrawal of consent at any time.
It should be noted that the receiving organisation must comply with any objection from the data subject without undue delay and at the latest within one month of receipt of the request or (if later) within one month.
Case Study
Company XYZ is recently launched a new feature called “Your Picks” that utilizes customer data to provide personalized product suggestions. One of the customers, Frank noticed a surge in personalized product recommendations. Feeling uneasy about the amount of data being analyzed and processed to generate these recommendations, John decided to exercise his right to object to data processing. John navigated to the platform’s privacy settings and found an option to opt-out of “Your Picks” and requested that his data not be used for this purpose. Company XYZ acknowledged John’s objection and immediately ensured that his personal data would no longer be used for generating personalized product suggestions.
An organization can also request for more detail about the identity of a person requesting an objection if it has doubts about the identity of such an individual. However, in exercising this power, it is important that the organisation only request information that is necessary to confirm who they are. The key to this is proportionality by considering what data they hold, the nature of the data, and what it is been used for.
Circumstances where one can object are:
- The data subject contests the accuracy of data held, while the data is verified.
- The processing is unlawful, but the data subject does not want the data erased.
- The data controller no longer needs the data, but the data subject needs it in order to establish or exercise legal claims or defenses.
- The data subject has exercised the right to object (see above), while it is being determined whether the data controller’s legitimate interests override this right.
However, in circumstances where the right is not absolute reasons must be given why one is objecting to the processing of your data.
The only real exceptions to the right to object is where such data is being processed for research purposes (historical, scientific, or statistical) and in cases when the data is essential for the public interest.
Conclusion
The data subject’s right to object serves as a check and balance in data processing activities, demanding organizations to carefully consider and assess the legality and necessity of their data processing practices. It not only reinforces the principle of data protection but also strengthens trust between individuals and data controllers. Overall, the data subject’s right to object is a fundamental aspect of data protection legislation, ensuring that individuals have a say in how their personal data is processed and ultimately preserving their privacy rights in an increasingly data-driven world.
Contibutor:
Wuyep Dinchi Poyi
REFERENCES
www.GriffinHouseConsultancy.co.uk
1https://dataprivacymanager.net
2https://www.privacypolicies.com/blog/gdpr-eight-user-rights/
