Under the GDPR, how does objecting to direct marketing differ from objecting to other legitimate-interest processing, and where does restriction fit?

## Two different objection rights Under the GDPR, `Art. 21` contains two rights that share a name and differ in strength. | | Art. 21(1) general objection | Art. 21(2)-(3) direct marketing | |---|---|---| | Which processing | Based on `Art. 6(1)(e)` public task or `(f)` legitimate interests, including profiling on those bases | Any processing for direct marketing, including profiling related to it | | What the person must show | Grounds relating to their particular situation | Nothing | | Controller's answer | May continue only with compelling legitimate grounds that override, or for legal claims | None: processing for marketing stops | | Outcome | Stop, unless the override is demonstrated | "shall no longer be processed for such purposes" | The burden in `Art. 21(1)` sits with the controller: it must *demonstrate* the compelling grounds. Recital 69 repeats that it is for the controller to show its compelling legitimate interest overrides. Recital 70 adds that the marketing objection may be exercised at any time and **free of charge**, whether it concerns initial or further processing. Note what `Art. 21(1)` does not cover: processing based on contract or legal obligation. A subscriber cannot use it to stop the billing the subscription requires. ## The streaming example A subscriber writes to a video-streaming service objecting to three things: 1. **Promotional emails about new releases.** This is direct marketing: `Art. 21(2)` and `(3)` apply, the emails stop, and the service has nothing to weigh. 2. **Profiling of viewing habits to target those promotions.** Profiling related to direct marketing is inside `Art. 21(2)`, so it stops on the same terms. 3. **Analysis of login patterns to detect account sharing, run on legitimate interests.** This is an `Art. 21(1)` objection: the subscriber must give grounds from their situation, and the service must stop unless it can demonstrate compelling legitimate grounds that override them. While it assesses that, the subscriber can ask for restriction. ## Restriction: Art. 18 `Art. 4(3)` defines **restriction of processing** as the marking of stored personal data with the aim of limiting its processing in the future. `Art. 18(1)` gives the right where: - **(a)** the person contests accuracy, for a period enabling the controller to verify it; - **(b)** the processing is unlawful and the person opposes erasure, asking for restriction instead; - **(c)** the controller no longer needs the data, but the person needs it for legal claims; - **(d)** the person has objected under `Art. 21(1)`, pending verification of whether the controller's grounds override theirs. Under `Art. 18(2)`, restricted data may, **apart from storage**, only be processed with the person's consent, for legal claims, for the protection of another natural or legal person's rights, or for reasons of important public interest of the Union or a Member State. `Art. 18(3)` requires informing the person **before** the restriction is lifted. Recital 67 lists methods: temporarily moving data to another system, making it unavailable to users, or removing published data from a website, with the restriction clearly indicated in the system and, in automated systems, ensured by technical means so the data cannot be further processed or changed. ## How the pieces connect - **Objection to erasure.** `Art. 17(1)(c)` makes an objection an erasure ground: under `Art. 21(1)` where there are no overriding legitimate grounds, and under `Art. 21(2)` without that condition. Erasure still has to be asked for, and the `Art. 17(3)` exceptions still apply. - **Recipients.** `Art. 19` requires communicating a restriction to each recipient of the data, unless impossible or disproportionate. - **Telling people.** `Art. 21(4)`: the rights in paragraphs 1 and 2 must be explicitly brought to the person's attention at the latest at the first communication, clearly and separately from other information. - **Automated objection.** `Art. 21(5)`: for information society services, the person may object by automated means using technical specifications. - **Timing.** The `Art. 12(3)` one-month clock applies to informing the person of the action taken. ## Common mistakes - Running a legitimate-interests balancing test against a marketing objection. - Asking the person to justify a marketing objection. - Treating restricted data as usable so long as it carries a flag. - Assuming any objection automatically erases all the person's data. - Offering the general objection against contract-based processing.