Section 4

Right to object and automated individual decision-making

Authors: Laura Carmichael, Emma Cradock and Sophie Stalla-Bourdillon

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

I. General remarks

As was the case with the DPD, there is no “general right” of an individual to object to all types of processing. Instead, Art. 21 affords the data subject a right to object to the processing of his or her personal data in the following three cases. First, there is a general right to object to all processing carried out on the basis that it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Art. 6 para. 1 lit. e), or for the purposes of the legitimate interests (Art. 6 para. 1 lit. f) of the controller (Art. 21 para. 1). Second, there is a specific right to object to the processing carried out for direct marketing purposes (Art. 21 para. 2). Third, there is a specific and qualified right to object to the processing for scientific or historical research or statistical purposes (Art. 21 para. 6).
It is only the right to object to the processing carried out for direct marketing purposes that is absolute, i.e. this is the only case where no exemptions are available to allow for the continuance of the processing when an individual objects (Art. 21 para. 2). Whereas objections to the processing based on the legitimate interests of the data controller or a task in the public interest or in the exercise of official authority can be overridden, if the data controller demonstrates compelling legitimate grounds or the processing is for the establishment, exercise or defence of legal claims (Art. 21 para. 1 sentence 2).

The right to object is linked to the right to erasure (→ Art. 17) – as a data subject can also invoke his or her right to erasure where “there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2)” (as per Art. 17 para. 1 lit. c). Note that both rights were relied upon simultaneously in Google Spain, in order to provide for the right to be delisted. The key difference is that the right to object focuses on a specific processing operation, whereas the right to erasure relates to personal data itself – regardless of why they are being processed. This means that, to satisfy the right to object in practice, the controller needs to stop further processing only for specified purposes. In contrast, the right to erasure prevents all processing and requires that data be no longer stored by the controller.

II. Legislative history

The right to object was initially introduced by Art. 14 of the DPD. While the scope of the right is essentially the same under Art. 21 of the GDPR – e.g., the right to object to personal data being processed for direct marketing purposes is retained – the GDPR now provides for more detail, as well as some additional requirements. There are four key differences between the DPD and the GDPR in relation to the right to object; these are summarised in the following paragraphs.

1. Reversal of the burden of proof (para. 1 sentence 2)

In terms of scope, the general right to object to processing (Art. 21 para. 1) remains unchanged from Art. 14 lit. a of the DPD, given that it still applies to the same lawful bases – i.e. where processing is carried out on the basis of public tasks or legitimate interests. However, under the DPD, it was for the data subject to provide a justified objection in order for the processing to cease. The GDPR reverses this burden and permits the data subject to object on a lower threshold of grounds relating to his or her particular situation. The controller must now “demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject” (as per recital 69 sentence 2), rather than the data subject having to evidence this to stop the processing.

[…]