INTRODUCTION
Another critical control mechanism introduced by the Data Protection Directive is the right to object, which is contained in Chapter II, section VII. The Directive envisages three situations in which the right to object will apply. These are:
Where the processing is necessary for the performance of public functions or where the processing is necessary for the data controller's legitimate interests. Member States are allowed to extend the right to object to other kinds of processing, but in all cases the data subject may only object on ‘compelling legitimate grounds relating to his particular situation’ (Article 14(a)). These higher barriers to objection are in place because of the second goal of data protection laws, the maintenance of transborder data flows.
Where the processing is for the purposes of direct marketing (Article 14(b)). The rules on direct marketing have been added to by the Directive on Privacy and Electronic Communications.118
Where decisions significantly affecting the data subject are based solely on automated processing. These decisions must be intended to evaluate personal aspects relating to the data subject, such as performance at work, creditworthiness, reliability and conduct.
The right to object is exercised by the data subject giving written notice to the data controller asking the data controller to cease, or to not begin, processing. Within the DPA the right to object is contained in sections 10, 11, 12 and 12A. Section 12A, which concerns certain types of manual processing, applies only until 23 October 2007. Each right to object is enforceable before the courts by the data subject.