导航
GDPR > 第 21 條. 拒絕權
下载PDF

第 21 條 GDPR. 拒絕權

Article 21 GDPR. Right to object

1. 資料主體應有權基於與其具體情況有關之理由,隨時拒絕依第 6 條第 1 項第 e 點或第 f 點規定所為有關其個人資料之處理,包括基於 該等條款所為之建檔。控管者應不得再處理該個人資料,除非該控管 者證明其處理有優先於資料主體權利及自由之法律依據、或為建立、 行使或防禦法律上請求所為之者。

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

專家評論
(EN) Author
Siarhei Varankevich
(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP
FIP_IAPP
(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant
献技

(69) 然而,於個人資料得被合法處理係因有處理之必要且符合公共 利益之執行職務、或委託控管者行使公權力、或基於控管者或第三人 之有正當利益之理由時,資料主體仍應有權基於其特殊情形拒絕任何 個人資料之處理。此時應由控管者證明其正當利益優先於資料主體之 利益或基本權與自由。

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.

相关文章

2. 為直接行銷目的處理個人資料時,該資料主體有權隨時拒絕為行銷目的所涉及其個人資料之處理,包括與該直接行銷有關範圍內之建 檔。

2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3. 當資料主體拒絕為直接行銷目的而處理個人資料時,該個人資料 不得再基於該目的而為處理。

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

献技

(70) 當個人資料之處理係以直接行銷為目的時,資料主體應有權在任 何時間且毋需任何費用拒絕該處理,包括在與直接行銷有關之範圍內 建檔,而不問係原始處理或進階處理。應明確提請資料主體注意該權 利,且清楚表達並與其他訊息區別。

(70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

4. 最遲於與資料主體第一次溝通時,應明確提請資料主體注意第 1 項及第 2 項所定權利,且清楚表達並與其他訊息區別。

4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 21(4) GDPR:

7.3.2 Determining information for PII principals

Control

The organization should determine and document the information to be provided to PII principals regarding the processing of their PII and the timing of such a provision.

Implementation guidance

The organization should determine the legal, regulatory and/or business requirements for when information is to be provided to the PII principal (e.g. prior to processing, within a certain time from when it is requested, etc.) and for the type of information to be provided.

 


访问全文

5. 在使用資訊社會服務之過程中,不問第 2002/58/EC 號指令規範為 何,資料主體得行使其權利,拒絕使用技術規範之自動化方式。

5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

6. 如個人資料之處理係依據第 89條第 1 項規定為科學或歷史研究目 的或統計目的所為者,資料主體應有權基於與其具體情況有關之理由, 拒絕與其有關之個人資料之處理,除非該處理係基於符合公共利益之 職務執行之理由而有必要者。

6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

相关文章
專家評論 ISO 27701 献技 指南和案例法 发表评论
專家評論

(EN)

Data Subject Request Letter Sample

Concern: Request to stop processing my personal data

Dear Madam, Dear Sir,

You have data concerning me that I am asking you to stop processing…


访问全文

(EN) Author
Louis-Philippe Gratton
(EN) Louis-Philippe Gratton PhD, LLM
(EN) Privacy Expert
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 21 GDPR:

7.3.5 Providing mechanism to object to PII processing

Control

The organization should provide a mechanism for PII principals to object to the processing of their PII.

Implementation guidance

Some jurisdictions provide PII principals with a right to object to the processing of their PII.


访问全文

献技

(69) 然而,於個人資料得被合法處理係因有處理之必要且符合公共 利益之執行職務、或委託控管者行使公權力、或基於控管者或第三人 之有正當利益之理由時,資料主體仍應有權基於其特殊情形拒絕任何 個人資料之處理。此時應由控管者證明其正當利益優先於資料主體之 利益或基本權與自由。

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.

(70) 當個人資料之處理係以直接行銷為目的時,資料主體應有權在任 何時間且毋需任何費用拒絕該處理,包括在與直接行銷有關之範圍內 建檔,而不問係原始處理或進階處理。應明確提請資料主體注意該權 利,且清楚表達並與其他訊息區別。

(70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

指南和案例法 发表评论
[js-disqus]