Right to Object under Article 21 GDPR
What Is the Right to Object?
The Right to Object under Article 21 GDPR allows data subjects to object, at any time, to the processing of their personal data where such processing is based on Article 6(1)(e) or (f) – public interest or legitimate interests.
When Can an Objection Be Raised?
Objections are especially relevant in these scenarios:
- Processing based on legitimate interests of the controller (Art. 6(1)(f))
- Processing in the public interest (Art. 6(1)(e))
- Processing for direct marketing purposes, including profiling
- Automated individual decisions with legal effect (possibly under Art. 22 GDPR)
In the case of direct marketing, the data subject has an absolute right to object without needing to provide any reason.
What Happens After an Objection?
Following an objection, the controller must stop processing the data unless:
- Compelling legitimate grounds are demonstrated that override the interests of the data subject
- The processing is necessary for legal claims
If the objection concerns direct marketing, all such processing must cease immediately and unconditionally.
How to Object?
The objection can be made informally, at any time and free of charge – in writing, electronically or verbally. The controller must inform the data subject clearly, separately and in a comprehensible manner at the latest upon first communication (Art. 12 in conjunction with Art. 21(4) GDPR).
Further Consequences and Rights
After a successful objection, the data subject may also request restriction of processing (Art. 18 GDPR) or erasure (Art. 17 GDPR).
Any violation of this right can be reported to the competent supervisory data protection authority.
