When submitting a data protection request (typically through a request form linked from a company’s privacy policy), there are two options that seem related to making sure your data isn’t sold or shared, but these forms don’t do a very good job of explaining the difference. The two options are:
1. Data Processing Objection Request
2. Data Processing Restriction Request
I feel like this is intentionally made to be confusing.
In: Other
1. The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.
Individuals have an absolute right to stop their data being used for direct marketing.
In other cases where the right to object applies you (the company) may be able to continue processing if you can show that you have a compelling reason for doing so.
2. Individuals have the right to request the restriction or suppression of their personal data.
This is not an absolute right and only applies in certain circumstances.
When processing is restricted, you (the company) are permitted to store the personal data, but not use it.
Source [The ICO](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/)
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-restrict-processing/
Right to Object: Stop using my data. All of it. Just stop.
Right to Restriction of Processing: Something came up. Stop using my data *until that issue is resolved*.
The Right to Restriction of Processing is *very limited*. GDPR lists only four cases where it exists, and one of those four is in tandem with a Right to Object.
1. The data you have about me is wrong, stop using it until you fix it.
1. It was illegal for you to have the data in the first place, but I don’t want you to delete it.
1. Normally this data would be deleted, but it’s part of a lawsuit so hold on to it but stop using it.
1. I told you to stop using all my data forever, but the lawyers are arguing about that request, so stop using it until the shouting stops.
By contrast, the Right to Object is much more broad, but still not universal and will lots of exemptions. The only reason you need is “I don’t like it.” But whether the Controller has to honor it depends on what their original legal basis for processing was.
Latest Answers