You have the right to object to the processing (use) of your personal data in some circumstances. If an organisation agrees to your objection, it must stop using your data for that purpose unless it can give strong and legitimate reasons to continue using your data despite your objections.
You have an absolute right to object to an organisation using your data for direct marketing – in other words, trying to sell things to you. This means it must stop using the data if you object.
How do you exercise your right to object?
Before objecting you may need to ask the organisation why it is processing your data. This is because you can only object to processing when the organisation is using your data:
• for a task carried out in the public interest
• for its legitimate interests
• for scientific or historical research, or statistical purposes, or
• for direct marketing.
What it tells you about why it is processing your personal data will show whether you can object.
If you’re able to object, you should inform the organisation directly that you object to any more processing of your data. You need to set out in your objection why you believe the organisation should stop using your data in this way.
A request can be verbal or in writing. We recommend you follow up any verbal request in writing because this will allow you to explain your concern, give evidence and state your desired solution. It will also provide clear proof of your actions if you decide to challenge the organisation’s initial response.
What you can do if you disagree with the outcome or remain dissatisfied?
If you are unhappy with how the organisation has handled your request, you should first complain to it.
Having done so, if you remain dissatisfied you can make a complaint to the ICO.
You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first.
What must the organisation do?
If your objection is successful, the organisation must stop processing your personal data for the use you have objected to. However, it may still be able to legitimately continue using your data for other purposes.
When can the organisation say no?
The organisation can refuse to comply with your objection if it can prove it has a strong reason to continue processing your data that overrides your objection. It can also refuse if it can prove that the use of your data is for a legal claim.
It should inform you of this outcome.
The organisation can also refuse to comply if it believes that your objection is, as the law states, “manifestly unfounded or excessive”. In reaching this decision, it can take into account whether your objection is repetitive.
In such circumstances the organisation can:
• request a reasonable fee to deal with the request, or
• refuse to deal with the objection.
In either case it will need to tell you and justify its decision.
How long should the organisation take?
The organisation has one month to respond to your objection. In certain circumstances it may need extra time to consider it and can take up to an extra two months. If it is going to do this, it should let you know within one month that it needs more time and why. For more on this, see our guidance on Time Limits.
Can it charge a fee for this?
An organisation can only charge a fee if the objection is “manifestly unfounded or excessive”. It may then ask for a reasonable fee to cover administrative costs associated with your objection.