Right to object
The right to object lets data subjects oppose the processing of their personal data, especially for direct marketing, where the objection applies at any time and requires no justification.
The right to object under Art. 21 GDPR allows data subjects to object at any time, on grounds relating to their particular situation, to the processing of their personal data. It applies where processing is based on a legitimate interest (Art. 6(1)(f) GDPR) or on the performance of a task carried out in the public interest (Art. 6(1)(e) GDPR). Following such an objection, the controller must stop processing the data unless it can demonstrate compelling legitimate grounds that override the interests of the data subject, or unless the processing serves the establishment, exercise or defence of legal claims.
The right to object is particularly strong in the context of direct marketing: under Art. 21(2) and (3) GDPR, the data subject may object at any time and without giving any reasons to processing carried out for direct marketing purposes. This objection is absolute, with no balancing of interests. Once an objection is made, the data may no longer be used for direct marketing, including any associated profiling. The controller must comply with the request without undue delay.
The controller must explicitly inform the data subject of the right to object at the latest at the time of the first communication, presenting this information clearly and separately from any other information (Art. 21(4) GDPR). Exercising the objection must be easy and free of charge for the data subject; in the context of information society services, the objection may also be exercised by automated means. Effective implementation requires clear internal processes, documented responses and, where appropriate, suppression lists, so that data subject to an objection is reliably excluded from marketing communications.
Legal Basis
Art. 21 GDPR (esp. paras 2 and 3 on direct marketing); Recital 70
Practical Example
An online retailer sends postal and electronic advertising to existing customers based on its legitimate interest. A customer writes to the address given in the newsletter: 'I no longer wish to receive any advertising.' The data protection coordinator logs the request, adds the customer to a central marketing suppression list, and ensures that future campaigns automatically check against this list. They also verify that the profiling associated with the advertising is stopped and confirm the implementation to the customer. In this way the absolute marketing objection under Art. 21(2) GDPR is fulfilled in a legally sound and demonstrable manner.