Right to object
[ch 4: page 31]If the data controller relies on the fifth or sixth of the lawful bases for processing the data (the performance of a task carried out in the public interest or in the exercise of official authority, or the legitimate interests of the data controller or a third party), then the individual has the right to object to the processing. The data controller cannot then process the data unless there are compelling legitimate grounds that override the individual’s rights, or for the purposes of a legal claim.
If processing is for direct marketing purposes, the individual can object at any time and the data controller can no longer process their data.
The individual must be informed of his or her right to object by the time of the first communication, at the latest, and this must be done clearly and separately from any other information.