Skip to main content

What happens if someone objects to my company processing their personal data?

Answer

Individuals have the right to object to the processing of personal data for specific reasons. Whether such a specific situation exists must be examined on a  case-by-case basis.

They may raise an objection only in cases where a public administration is processing the data in the context of its public tasks or when a company is processing the data on the basis of its legitimate interests. In such cases, your company/organisation may no longer process the data unless it demonstrates that it needs to process it for reasons that override the rights and freedoms of the individual or if the data is necessary for the establishment, exercise or defence of legal claims.

Individuals also have a right to object at any time to the processing of their personal data for direct marketing purposes. Direct marketing is understood under the General Data Protection Regulation as any action by a company to communicate advertising or marketing material, aimed at particular individuals. Your company/organisation  must inform individuals in its privacy notice or at the latest at the time of the first communication with individuals, that it will be using their personal data for direct marketing and that they have a right to object free of charge. Where a person objects to processing for direct marketing purposes, your company/organisation  may no longer process their personal data for such purposes.

Example

In the insurance sector, very often the personal data is needed for the defence of legal claims in the case of anti-fraud or anti-money laundering measures. In those cases insurance companies may refuse to uphold an individual’s request to object based on reasons that override the rights and freedoms of the individual.