Right to object under UK GDPR: how to stop the use of your data

You may have noticed adverts that follow you after a single website visit, or messages from a company you never chose to hear from. Data protection law gives you a tool for this: the right to object. It lets you tell an organisation to stop using your personal information for a given purpose.

This article follows the guidance of the Information Commissioner's Office (ICO), the UK regulator. It covers what the right allows, when it applies, how to use it and what response to expect.

What the right to object allows

You can ask organisations to stop using your personal information. This is known as the "right to object". You can submit a request at any time to show that you want an organisation to stop.

Organisations can sometimes use your information without your consent, but that does not mean you lose all control over it. The catch is that an organisation only needs to comply with your request in certain circumstances.

If you previously consented and now want to withdraw that consent, the organisation must stop using your information. You do not need to submit a right to object request for this. You can simply make it clear that you withdraw your consent.

When you can object

You have the right to object when an organisation uses your personal information for:

• Direct marketing. This means advertising or marketing aimed at you specifically, by any form of communication (for example emails, post and calls). Organisations cannot refuse if you object to this. It does not apply to market research or routine customer service messages.
• Exercising official authority. This covers public functions and powers set out in law, such as those of government departments and local authorities.
• A task carried out in the public interest. Both private and public sector organisations can do this.
• Scientific or historical research, or statistical purposes. The exception is where the use is necessary for a task in the public interest.
• Their "legitimate interest". Organisations cannot simply decide that something is a legitimate interest. They must identify their purpose and why it is legitimate, justify why using your information is necessary, and balance their interests against yours.
• A "recognised legitimate interest". These are interests treated as legitimate by default, such as prevention of crime or safeguarding vulnerable people. You can still object to them.

You cannot object where the information is needed for a contractual obligation between you and the organisation, for a legal obligation, or to protect your life or someone else's life.

In practice you may not know why an organisation is using your information. The ICO says you should be able to find this in the privacy policy or privacy notice on its website.

Objecting to advertising and marketing

Yes, you can object to advertising or promotional messages. The ICO calls this "direct marketing", and organisations cannot carry on sending you these messages once you object. They also cannot keep using your information to try to sell or promote things to you.

That does not automatically mean they must erase everything they hold. The ICO says it is likely that organisations will put you on a "suppression list", a list of people who have said they do not want their information used for direct marketing. They can keep your name there so they can comply with your request and do not send you marketing again by mistake.

The ICO gives an example. A holidaymaker books a hotel online and later sees hotel adverts in a social media feed. The privacy notice shows that the site shares information with social media platforms for advertising. The person objects, and the organisation agrees to stop sharing. It explains that it still needs to use their information for other reasons, such as communicating about the upcoming booking.

How to object

The ICO says you should do three things:

1. Contact the organisation directly.
2. Tell it what use of your information you are objecting to.
3. Explain why you are objecting.

It is important to be clear on both the use and the reasons, because the organisation may decide whether to comply based on what you tell it. If you are not sure how to get in touch, look for the contact details in the privacy policy or privacy notice on its website.

You can make your request verbally or in writing at any time. The ICO recommends following up any verbal request in writing. This lets you explain your request, provide evidence, say what you want to happen and prove what you asked for if you later want to challenge the response.

The ICO also provides a template letter. It asks you to give your details, describe the use of your information you object to and the specific reasons, and request a full response within one calendar month. It also asks the organisation to tell you when it will respond if it cannot do so in that time.

You can ask someone else to submit the request for you, but they will need to send proof that they are authorised to act on your behalf. An organisation may ask for written permission from you or a power of attorney document. It does not have to comply if it is not satisfied that the person has permission.

What response to expect

Organisations need to respond within one calendar month. They can extend this by up to two months for complex requests, but they must tell you and explain why they need more time.

They may ask you to clarify the scope of your request. They may also ask for ID, although they should not do so if your identity is obvious to them, and should only ask for what is reasonable and proportionate. The one-month limit starts once the organisation has received your ID. If it asks for more information or ID, the ICO says you should provide it so the request can be dealt with.

If your request is successful, the organisation must stop, or not begin, using your information for the purpose you objected to. It may still be able to use it for other purposes.

Organisations can only charge a fee if the objection is "manifestly unfounded or excessive".

When an organisation can refuse

Except for direct marketing, an organisation may refuse your request if it:

• can show it has a strong reason to continue using your information;
• needs the information for legal reasons or a legal claim;
• needs it to comply with a contract between you and the organisation;
• needs it to save your life or someone else's life;
• can rely on an exemption within data protection law, in which case it does not always have to tell you that it has used one;
• believes the request is "manifestly unfounded", meaning made with no real purpose except harassment or disruption; or
• believes the request is "excessive", meaning it overlaps with or repeats a previous request already dealt with properly.

If it considers a request manifestly unfounded or excessive, it should explain its reasoning. If it decides to carry on using your information, it should tell you the outcome and explain why.

If there is no reply or you are unhappy

First make a data protection complaint to the organisation and give it the chance to resolve the matter. It must acknowledge your complaint within 30 days, keep you informed of progress and give you an outcome without unjustifiable or excessive delay.

If you remain dissatisfied, you can complain to the ICO. You can do so at any point, but the ICO recommends giving the organisation the chance to complete its own process first. You can also seek to enforce your rights through the courts. If you decide to do that, the ICO strongly advises you to seek independent legal advice first.

Finding out who uses your information

To object, you first need to know which organisations hold your details. Remove Me offers a free scan with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (via Have I Been Pwned) and a register of data brokers, then shows a report. A 6-digit code sent by e-mail unlocks the report.

Remove Me does not yet send erasure requests on your behalf, so any objection described above is something you make yourself, organisation by organisation.

The Remove Me team