What is the right to object?
You have the right to object to an organisation processing (using) your personal data at any time. This effectively means that you can stop or prevent the organisation from using your data. However it only applies in certain circumstances, and they may not need to stop if the organisation can give strong and legitimate reasons to continue using your data.
When can I object?
You can only object to processing when the organisation is using your data:
- for a task carried out in the public interest;
- for the exercise of official authority;
- for their legitimate interests;
- for scientific or historical research, or statistical purposes; or
- for direct marketing purposes.
Can I object to direct marketing?
Yes. The right to object to direct marketing is stronger than any objections you can make about other uses of your data.
If you object, the organisation cannot refuse your objection and must stop using your data for direct marketing purposes. For example, they cannot carry on using your data to try to sell or promote things to you.
However, this does not automatically mean that the organisation needs to erase all your personal data. They may put you on their ‘suppression list’ – this is their list of people who have said that they don’t want their data used for direct marketing purposes. Having a suppression list means that if the organisation buys any new direct marketing lists they can check against it to make sure they don’t use your data for direct marketing when you have asked them not to.
How do I exercise my right to object?
If you’re able to object, you should inform the organisation directly that you don’t want them to process your data. You need to explain why you believe the organisation should stop using your data in this way.
You can make your request verbally or in writing. We recommend you follow up any verbal request in writing because this will allow you to explain your complaint, give evidence and state what you want to happen. You will also have clear proof of your actions, if you decide to challenge the organisation’s response.
There are no specific words that you must use, but you may find it useful to use the template below to help you exercise your right to object.
[Your full address]
[Name and address of the organisation]
Dear [Sir or Madam / name of the person you have been in contact with]
Right to object
[Your full name and address and any other details such as account number to help identify you]
I wish to exercise my right under data protection law to object to the processing of my personal data.
[Give details of what use of your personal data you are objecting to, explaining clearly and simply the specific reasons why you are objecting.]
You can find guidance on your obligations under information rights legislation on the Information Commissioner’s Office website (www.ico.org.uk) as well as information on their regulatory powers and the action they can take.
Please send a full response within one calendar month confirming if you will comply with my request. If you cannot respond within that timescale, please tell me when you will be able to respond.
If there is anything you would like to discuss, please contact me.