Right to object

The right to object is the right of the data subject to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the public interest or official authority (Art. 6(1)(e)) or on legitimate interests (Art. 6(1)(f)), including profiling based on those provisions. The controller must then stop processing unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or the processing is needed for legal claims (Art. 21(1) GDPR).

Where personal data are processed for direct marketing, the right to object is absolute: processing for that purpose must cease on objection, without any balancing (Art. 21(2) and (3)). The right must be explicitly brought to the attention of the data subject at the latest at the time of the first communication, clearly and separately from other information (Art. 21(4)), and may be exercised by automated means in the context of information society services (Art. 21(5)).

Art. 21(6) contains a research-specific rule: where personal data are processed for scientific or historical research or statistical purposes, the data subject may object on grounds relating to their particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest. Member State law implementing Art. 89(2) may further limit the right where it would seriously impair the research. For sponsors relying on legitimate interest for trial data or on secondary use of health records, this means that an objection procedure must exist, that compelling grounds (data integrity, patient safety, regulatory obligations) must be assessed and documented case by case, and that the informed consent form or notice must mention the right. Objections to pharmacovigilance processing, which rests on legal obligation, are not available.