The right to object to the use of your data

What is the right to object?

You have the right to object to an organisation processing (using) your personal data at any time. This effectively means that you can stop or prevent the organisation from using your data. However it only applies in certain circumstances, and they may not need to stop if the organisation can give strong and legitimate reasons to continue using your data.

When can I object?

You can only object to processing when the organisation is using your data:

• for a task carried out in the public interest;
• for the exercise of official authority;
• for their legitimate interests;
• for scientific or historical research, or statistical purposes; or
• for direct marketing purposes.

Can I object to direct marketing?

Yes. The right to object to direct marketing is stronger than any objections you can make about other uses of your data.

If you object, the organisation cannot refuse your objection and must stop using your data for direct marketing purposes. For example, they cannot carry on using your data to try to sell or promote things to you.

However, this does not automatically mean that the organisation needs to erase all your personal data. They may put you on their ‘suppression list’ – this is their list of people who have said that they don’t want their data used for direct marketing purposes. Having a suppression list means that if the organisation buys any new direct marketing lists they can check against it to make sure they don’t use your data for direct marketing when you have asked them not to.

How do I exercise my right to object?

If you’re able to object, you should inform the organisation directly that you don’t want them to process your data. You need to explain why you believe the organisation should stop using your data in this way.

You can make your request verbally or in writing. We recommend you follow up any verbal request in writing because this will allow you to explain your concern, give evidence and state what you want to happen. You will also have clear proof of your actions, if you decide to challenge the organisation’s response.

There are no specific words that you must use, but you may find it useful to use the template below to help you exercise your right to object.

[Your full address] [Phone number] [The date] [Name and address of the organisation] [Reference number (if provided within the initial response)] Dear [Sir or Madam / name of the person you have been in contact with] Right to object [Your full name and address and any other details such as account number to help identify you] I wish to exercise my right under data protection law to object to the processing of my personal data. [Give details of what use of your personal data you are objecting to, explaining clearly and simply the specific reasons why you are objecting.] You can find guidance on your obligations under information rights legislation on the Information Commissioner’s Office website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take. Please send a full response within one calendar month confirming if you will comply with my request. If you cannot respond within that timescale, please tell me when you will be able to respond. If there is anything you would like to discuss, please contact me. Yours faithfully [Signature]

What must the organisation do?

If your objection is successful, the organisation must stop or not begin processing your personal data for that use. However, they may still be able to legitimately continue using your data for other purposes.

If you have objected to the organisation using your personal data for direct marketing then they must stop using your data for these purposes.

When can the organisation say no?

If you have objected to direct marketing the organisation cannot say no. However, if you have objected about other uses, they can refuse to comply with your objection, but only if they can prove they have a strong reason to continue processing your data that overrides your objection. They can also refuse if they can prove that they are using your data for a legal claim.

They should tell you the result of your objection.

Data protection law also contains exemptions. If an exemption applies, the organisation can either fully or partly refuse to comply with your request.

The organisation can also refuse to comply if they believe that your objection is, as the law states, ‘manifestly unfounded or excessive’.

There is no set definition of what makes a request ‘manifestly unfounded or excessive’. It will depend on the particular circumstances of your request. As an example, an organisation may consider a request to be ‘manifestly unfounded or excessive’ when it is clear that it has been made with no real purpose except to cause them harassment or disruption to the organisation.

In such circumstances the organisation can:

• request a reasonable fee to deal with the request; or
• refuse to deal with the objection.

In either case it will need to tell you and justify its decision.

If, having considered your request, the organisation decides it does not need to stop or not to begin processing your data, it must still respond to you. It should explain to you why it believes it does not have to comply, and let you know about your right to complain about this decision to the ICO, or through the courts.

How long should the organisation take?

The organisation has one month to respond to your objection. In certain circumstances it may need extra time to consider your case and can take up to an extra two months. If it is going to do this, it should let you know within one month that it needs more time and why. For more on this, see our guidance on time limits.

Can it charge a fee for this?

An organisation can only charge a fee if the objection is ‘manifestly unfounded or excessive’. It may then ask for a reasonable fee to cover administrative costs associated with your objection.

What to do if the organisation does not respond or you are dissatisfied with the outcome

If you are unhappy with how the organisation has handled your request, you should first raise a concern with them and give them the opportunity to resolve the matter

Having done so, if you remain dissatisfied you can make a complaint to the ICO.

You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first.