Navigazzjoni
RĠPD (GDPR) > Artikolu 21. Dritt ta' oġġezzjoni
Download PDF

Artikolu 21 RĠPD (GDPR). Dritt ta' oġġezzjoni

Article 21 GDPR. Right to object

1. Is-suġġett tad-data għandu d-dritt li joġġezzjona, għal raġunijiet relatati mas-sitwazzjoni partikolari tiegħu, fi kwalunkwe mument għall-ipproċessar ta’ data personali li tikkonċerna lilu li hija bbażata fuq il-punt (e) jew (f) tal-Artikolu 6(1), inkluż it-tfassil ta’ profili abbażi ta’ dawk id-dispożizzjonijiet. Il-kontrollur ma għandux jibqa’ jipproċessa d-data personali sakemm il-kontrollur ma jagħtix raġunijiet leġittimi konvinċenti għall-ipproċessar li jegħlbu l-interessi, id-drittijiet u l-libertajiet tas-suġġett tad-data jew għall-istabbiliment, l-eżerċizzju jew id-difiża ta’ talbiet legali.

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Kummentarju
(EN) Author
Siarhei Varankevich
(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP
FIP_IAPP
(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant
Premessi

(69) Fejn id-data personali tista' tiġi pproċessata legalment minħabba li huwa meħtieġ ipproċessar għat-twettiq ta' kompitu li jsir fl-interess pubbliku jew fl-eżerċizzju ta' awtorità uffiċjali mogħtija lill-kontrollur, jew għal raġunijiet ta' interessi leġittimi ta' kontrollur jew parti terza, suġġett tad-data għandu, madankollu, jkun intitolat joġġezzjona għall-ipproċessar ta' kwalunkwe data personali relatata mas-sitwazzjoni partikolari tiegħu. Għandha tkun ir-responsabbiltà tal-kontrollur li juri li l-interess leġittimu konvinċenti tiegħu jegħleb l-interessi jew id-drittijiet u l-libertajiet fundamentali tas-suġġett tad-data.

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.

Testi relatati

2. Fejn tiġi pproċessata data personali għal għanijiet diretti ta’ kummerċjalizzazzjoni, is-suġġett tad-data għandu d-dritt li joġġezzjona fi kwalunkwe mument għall-ipproċessar tad-data personali li tikkonċernah għal tali kummerċjalizzazzjoni, li tinkludi t-tfassil tal-profili sa fejn huwa marbut ma’ tali kummerċjalizzazzjoni diretta.

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3. Fejn is-suġġett tad-data joġġezzjona għall-ipproċessar għal għanijiet ta’ kummerċjalizzazzjoni diretta, id-data personali ma għandhiex tibqa’ tiġi pproċessata għal tali għanijiet.

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Premessi

(70) Fejn id-data personali tkun ipproċessata għall-għanijiet ta' kummerċjalizzazzjoni diretta, is-suġġett tad-data għandu jkollu d-dritt li joġġezzjona għal dan l-ipproċessar, inkluż it-tfassil ta' profili sa fejn dan ikun relatat ma' tali kummerċjalizzazzjoni diretta, kemm fir-rigward tal-ipproċessar inizjali kif ukoll dak ulterjuri, fi kwalunkwe ħin u bla ħlas. Għandha tinġibed l-attenzjoni tas-suġġett tad-data espliċitament għal dak id-dritt, u dan għandu jiġi ppreżentat b'mod ċar u separatament minn kwalunkwe informazzjoni oħra.

(70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

4. Mhux aktar tard mill-mument tal-ewwel komunikazzjoni mas-suġġett tad-data, id-dritt imsemmi fil-paragrafi 1 u 2 għandu jinġieb għall-attenzjoni tas-suġġett tad-data b’mod espliċitu u għandu jiġi ppreżentat b’mod ċar u separatament minn kwalunkwe informazzjoni oħra.

4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 21(4) GDPR:

7.3.2 Determining information for PII principals

Control

The organization should determine and document the information to be provided to PII principals regarding the processing of their PII and the timing of such a provision.

Implementation guidance

The organization should determine the legal, regulatory and/or business requirements for when information is to be provided to the PII principal (e.g. prior to processing, within a certain time from when it is requested, etc.) and for the type of information to be provided.

 

(EN) […]


to read the full text

5. Fil-kuntest tal-użu ta’ servizzi tas-soċjetà tal-informazzjoni, u minkejja d-Direttiva 2002/58/KE, is-suġġett tad-data jista’ jeżerċita d-dritt tiegħu li joġġezzjona b’mezzi awtomatizzati bl-użu ta’ speċifikazzjonijiet tekniċi.

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

6. Fejn tiġi pproċessata data personali għal finijiet ta’ riċerka xjentifika jew storika jew għal finijiet ta’ statistika skont l-Artikolu 89(1), is-suġġett tad-data, għal raġunijiet marbutin mas-sitwazzjoni partikolari tiegħu, għandu d-dritt li joġġezzjona għall-ipproċessar tad-data personali li tikkonċernah, sakemm l-ipproċessar ma jkunx neċessarju għall-prestazzjoni ta’ kompitu mwettaq għal raġunijiet ta’ interess pubbliku.

6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Testi relatati
Kummentarju ISO 27701 Premessi Linji ta 'Gwida & Ġurisprudenza Ħalli kumment
Kummentarju

(EN)

Data Subject Request Letter Sample

Concern: Request to stop processing my personal data

Dear Madam, Dear Sir,

You have data concerning me that I am asking you to stop processing…

(EN) […]


to read the full text

(EN) Author
Louis-Philippe Gratton
(EN) Louis-Philippe Gratton PhD, LLM
(EN) Privacy Expert
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 21 GDPR:

7.3.5 Providing mechanism to object to PII processing

Control

The organization should provide a mechanism for PII principals to object to the processing of their PII.

Implementation guidance

Some jurisdictions provide PII principals with a right to object to the processing of their PII.

(EN) […]


to read the full text

Premessi

(69) Fejn id-data personali tista' tiġi pproċessata legalment minħabba li huwa meħtieġ ipproċessar għat-twettiq ta' kompitu li jsir fl-interess pubbliku jew fl-eżerċizzju ta' awtorità uffiċjali mogħtija lill-kontrollur, jew għal raġunijiet ta' interessi leġittimi ta' kontrollur jew parti terza, suġġett tad-data għandu, madankollu, jkun intitolat joġġezzjona għall-ipproċessar ta' kwalunkwe data personali relatata mas-sitwazzjoni partikolari tiegħu. Għandha tkun ir-responsabbiltà tal-kontrollur li juri li l-interess leġittimu konvinċenti tiegħu jegħleb l-interessi jew id-drittijiet u l-libertajiet fundamentali tas-suġġett tad-data.

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.

(70) Fejn id-data personali tkun ipproċessata għall-għanijiet ta' kummerċjalizzazzjoni diretta, is-suġġett tad-data għandu jkollu d-dritt li joġġezzjona għal dan l-ipproċessar, inkluż it-tfassil ta' profili sa fejn dan ikun relatat ma' tali kummerċjalizzazzjoni diretta, kemm fir-rigward tal-ipproċessar inizjali kif ukoll dak ulterjuri, fi kwalunkwe ħin u bla ħlas. Għandha tinġibed l-attenzjoni tas-suġġett tad-data espliċitament għal dak id-dritt, u dan għandu jiġi ppreżentat b'mod ċar u separatament minn kwalunkwe informazzjoni oħra.

(70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

Linji ta 'Gwida & Ġurisprudenza Ħalli kumment
[js-disqus]