What is the right to object? Article 21 of the UK GDPR gives individuals the right to object to the processing of their personal data at any time. This effectively allows individuals to stop or prevent you from processing their personal data.
An objection may be in relation to all of the personal data you hold about an individual or only to certain information. It may also only relate to a particular purpose you are processing the data for.
Processing based upon public task or legitimate interests An individual can also object where you are relying on one of the following lawful bases:
‘public task’ (for the performance of a task carried out in the public interest), ‘public task’ (for the exercise of official authority vested in you), or legitimate interests. An individual must give specific reasons why they are objecting to the processing of their data. These reasons should be based upon their particular situation.
In these circumstances this is not an absolute right, and you can refuse to comply if:
you can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual; or the processing is for the establishment, exercise or defence of legal claims. If you are deciding whether you have compelling legitimate grounds which override the interests of an individual, you should consider the reasons why they have objected to the processing of their data. In particular, if an individual objects on the grounds that the processing is causing them substantial damage or distress (eg the processing is causing them financial loss), the grounds for their objection will have more weight. In making a decision on this, you need to balance the individual’s interests, rights and freedoms with your own legitimate grounds. During this process you should remember that the responsibility is for you to be able to demonstrate that your legitimate grounds override those of the individual.
If you are satisfied that you do not need to comply with the request you should let the individual know. You should explain your decision, and inform them of their right to make a complaint to the ICO or another supervisory authority; and their ability to seek to enforce their rights through a judicial remedy.