You have the right to object to the processing (use) of your personal data in some circumstances. If an organisation agrees to your objection, it must stop using your data for that purpose unless it can give strong and legitimate reasons to continue using your data despite your objections.
You have an absolute right to object to an organisation using your data for direct marketing – in other words, trying to sell things to you. This means it must stop using the data if you object.
How do you exercise your right to object?
Before objecting you may need to ask the organisation why it is processing your data. This is because you can only object to processing when the organisation is using your data:
• for a task carried out in the public interest
• for its legitimate interests
• for scientific or historical research, or statistical purposes, or
• for direct marketing.
What it tells you about why it is processing your personal data will show whether you can object.
If you’re able to object, you should inform the organisation directly that you object to any more processing of your data. You need to set out in your objection why you believe the organisation should stop using your data in this way.
A request can be verbal or in writing. We recommend you follow up any verbal request in writing because this will allow you to explain your concern, give evidence and state your desired solution. It will also provide clear proof of your actions if you decide to challenge the organisation’s initial response.
What to do if the organisation does not respond or you are dissatisfied with the outcome
If you are unhappy with how the organisation has handled your request, you should first complain to it.
Having done so, if you remain dissatisfied you can make a complaint to the ICO.
You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first.
How should I raise my concern about how an organisation has handled my information?
You can use the template letter below to help you raise your concerns.
|
[Your full address] [Name and address of the organisation] Dear [Sir or Madam / name of the person you have been in contact with] Information rights concern I am concerned that you have not handled my personal information properly. [Give details of your concern, explaining clearly and simply what has happened and, where appropriate, the effect it has had on you.] I understand that before reporting my concern to the Information Commissioner’s Office (ICO) I should give you the chance to deal with it. If, when I receive your response, I would still like to report my concern to the ICO, I will give them a copy of it to consider. You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take. Please send a full response within one calendar month. If you cannot respond within that timescale, please tell me when you will be able to respond. If there is anything you would like to discuss, please contact me on the following number [telephone number]. Yours faithfully |