The right to object – Article 21 GDPR under the microscope

In order to adequately grasp the scope of application of Art. 21 GDPR, it is first necessary to take a look at the legal bases of Art. 6 GDPR.

According to Art. 6(1)(f) DSGVO, a company is entitled to use personal data if the specific data processing is necessary to achieve a so-called “legitimate interest”. However, in order to determine whether the legal basis of Art. 6 (1) lit. f DSGVO can be used, the company is obliged to carry out a balancing of interests. Here it is then determined whether the interest of the company is so weighty that it outweighs the rights and freedoms of the data subjects. This must always be based on a generalized consideration. This means that the rights and freedoms of the data subjects are determined on the basis of an average person affected by the data processing to the usual and foreseeable extent.

The specific effects on an individual person are not to be taken into account. Likewise, the consent or other agreement of the data subject is not required.

So how does this legal basis fit into the concept of the GDPR? After all, a fundamental principle of data protection legislation is that every natural person is entitled to control the use of their data. One might think that Article 6 (1) (f) of the GDPR has the opposite effect. After all, here a company is entitled to decide on data processing without the consent of the data subject.

This is where the right to object according to Art. 21 DSGVO comes into play. The data subject does not simply have to acquiesce to the data processing. Rather, he or she can lodge an objection with the company and thus prevent the data processing under certain circumstances.

However, a basic distinction must be made between three constellations, which grant the data subject a right to object to a different extent.

As already explained in an earlier article, the sending of direct marketing is permissible under certain circumstances according to Art. 6 (1) lit. f DSGVO. This special situation is now taken into account by Article 21 (2) of the GDPR, which grants the data subject a special right to object.

If a company bases the sending of direct advertising on legitimate interest, the data subject has a right to object to the associated data processing. What is special here is that this right of objection is unconditional and must be taken into account by the responsible party at all times and in full.

In contrast, there is the “general” right of objection under Article 21(1) of the GDPR against other forms of data processing operations based on Article 6(f) of the GDPR. It is important to note here that the data subject does not always have the possibility to unilaterally prevent a data processing that is lawful in itself. Instead, the data subject must show why, for factual reasons arising from his or her person, the right to object exists. If these special reasons exist, the controller must again perform a balancing of interests, this time according to the standard of Art. 21 (1) sentence 2 DSGVO. In doing so, contrary to the procedure according to Art. 6 (1) f DSGVO, the concrete and individual situation of the applicant must be taken into account. If the result of the balancing of interests is that compelling reasons also support the processing in the specific case and these outweigh the rights and freedoms of the data subject, the data processing can continue.

This procedure sounds quite complicated. But this ensures that the individual concern of a specific person is also sufficiently taken into account in data processing pursuant to Art. 6(1)(f) DSGVO.

Article 21 (6) of the GDPR also grants data subjects the right to object to data processing for scientific purposes. However, here too, the applicant must present specific reasons on his or her own behalf and the controller must perform a balancing of interests before making a decision. In this context, the data processing must only be stopped if it is not necessary for the fulfillment of a task in the public interest.

We will be happy to support you in the areas of data protection and IT security.

You can reach us at our headquarters in Hutthurm near Passau at +49 (0) 8505 91927 – 0 and at our branch in Munich at +49 (0) 89 413 2943 – 0 or use our contact form.