Right to object and right to restriction of processing

The next set of rights that is worth examining includes the right to object and the right to restriction of processing. The right to object is conferred to all data subjects by the General Data Protection Regulation. Namely, there can be grounds relating to persons’ particular situations that justify the exercise of this right in relation to the processing of their personal data. This is the case when this processing is necessary for the performance of tasks in the public interest, is required in the exercise of official authority by the data controllers, or when this processing must be carried out for the purposes of the legitimate interests pursued by the controllers or third parties.

The right to object also exists when there are profiling activities carried out in these situations. Appealing to this right prevents the controllers from the further processing of personal data. They can, however, continue to process this information if compelling legitimate grounds for the processing can be demonstrated that override interests, rights, and freedoms of data subjects. The same is also the case when there are compelling legitimate grounds for the establishment, exercise, or defence of legal claims. Let’s imagine that Google decides to promote developments in the field of software and hardware products and starts to gather data on the most talented software developers living in a certain municipality of a small EU Member State.

The information - including first and last names, places of residence, and age - is then collected, processed, and stored by Google. These data are then published on a special website developed by Google that is used for the public interest of knowing how local software geniuses perform. Our app developer has then a perfect legal right to object at any time against such processing, while Google, as a controller will have to stop its processing activities. What is highly relevant to all of us nowadays is the fact that this right can also be exercised when personal data of individuals are processed in the context of direct marketing or profiling related to such marketing. It can be done at any time.

And when data subjects object, their personal data may not be processed anymore for direct marketing. At the time of the first communication with data subjects, the existence of the right to object– as addressed earlier– must be indicated to data subjects in a clear manner and separately from other information. This right can be exercised by data subjects when we deal with the use of information society services by automated means using technical specifications. Importantly, the right to object also exists when individuals’ personal data are processed for scientific or historical research or statistical purposes. This is, however, not the case if the processing is carried out for reasons of public interest. Finally, the GDPR establishes the right to restriction of processing.

Data subjects have the right to obtain from controllers a restriction of processing when one of the following conditions applies. First, data subjects contest the accuracy of the personal data for a period enabling controllers to verify the accuracy of these data. Second, the processing is unlawful and data subjects, oppose the erasure of their personal data and request the restriction of their use instead. Third, controllers no longer need personal data for the purposes of the processing, but these data are required by data subjects for the establishment, exercise, or defence of legal claims. Fourth, data subjects object to the processing pending the verification, whether the legitimate grounds of controllers override those of data subjects.

Let’s think again of our app developer and assume in this example that she is extremely happy to be listed as number one of all local software developers, but the information provided about her is not correct. She does not live anymore in the place listed on the website created by Google. In this case, the app developer may request the restriction of processing of her personal data for a period that Google, as a controller, would need to verify whether the data in question are indeed inaccurate.

When one of the above-mentioned conditions apply, and the processing is restricted, personal data may further be processed, but not stored, only with the consent of data subjects for the establishment, exercise, or defence of legal claims; for the protection of the rights of other natural legal persons; or for reasons of important public interest of the European Union or its Member States. When the restriction of processing has been obtained, controllers need to inform data subjects before this restriction is lifted. We have just focused on two essential rights under the General Data Protection Regulation that allow data subjects to object against the processing of their personal data and to restrict this processing.

These rights further empower data subjects and give them more control over their personal information.