If an individual feels that their data has been incorrectly or inappropriately (ie illegally) processed, you are required to respond to their request with a course of action and to handle the case on its merits.
You must ensure that the individual knows, at the point when they first interact with you, that they are entitled to object. Your Privacy Notice must clearly state that objections can be made and how they should be directed.
Objections can be made both verbally or in written form.
You must verify the identity of the person making the request, using “Reasonable Means”.
You should respond to a request without delay and at least within one month of receipt.
You can extend this period by a further two months for complex or numerous requests (in which case you must inform the individual and give an explanation).
Although an individual may object, the right for them to do so is not always absolute as this depends why the data is being processed.
Where the objection relates to data being used for direct marketing purposes, then the individual has an absolute right both to object and to have that activity stopped. In these circumstances, you must immediately stop using their data for direct marketing – you get no choice once the individual has made their objection known.
The individual can also object in other situations – but here this may not be an absolute right:
- Where data is being used to fulfil a legitimate interest of your organisation
- Where data is being used in the public interest
- Where data is being used in the exercise of official authority
But if you can prove that:
- there are strong and justifiable legal grounds for processing the data that outweigh the interests, rights and freedoms of the individual; or
- the personal data is processed for scientific or historical or statistical purposes that lies within the public interest
then the right to object is not absolute and you may continue to process their data for these reasons.
Make sure to keep a record of this change of justification for why you continue to process their data.
You will also have to inform the individual of your decision and your reasoning for it.