Key References:

  • GDPR Art. 18 (right to restriction of processing)
  • GDPR Art. 21 (right to object to processing)
  • Recitals 67, 69, 70

History and key elements of Arts. 18 and 21:

  • The GDPR has significant enhanced individuals’ right to object or seek restriction of processing of their personal data.
  • Art. 18:
    • Data subject has the right to seek restriction (suspension) of processing of personal data when:
      • contesting the accuracy of the data,
      • the processing is unlawful and data subject chooses restriction over erasure,
      • the controller no longer needs the data but data subject requires it for a legal claim,
      • data subject objects to processing of data under Art. 21 and legitimate interest resolution is pending.
    • Controllers may refuse to comply with Art. 18 if an exemption applies and inform the data subject of their reasons within one month (See UK ICO Guidance on right to rectification).
    • Recital 67 states that controllers should have the ability to temporarily restrict processing so that personal data are not subject to further processing operations and cannot be changed.
  • Art. 21:
    • Data subject has the right to object to processing of personal data when:
      • challenging the lawful basis of processing,
      • challenging public interest processing under Art. 6(1)(e),
      • challenging controller’s legitimate interests in processing under Art. 6(1)(f),
      • opting out of direct marketing.
    • Under Art. 21(1) and Recital 69, controller may refuse to fulfil data subject’s Art. 21 rights where “the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims“.
  • Art. 19 places an obligation on the controller to communicate data rectification to data subjects.
  • The time period under Art. 12(3) to respond to DSAR requests (one month, and additional two months for complex or numerous requests) also applies to DSARs under Arts. 18 and 21.