Acts 2017
506
(c)
the processing is unlawful and the data subject opposes
the erasure of the personal data and requests the
restriction of their use instead; or
(d)
the data subject has objected to the processing pursuant
to section 41 pending verification as to whether the
legitimate grounds of the controller override those of
the data subject.
(6) Where processing of personal data is restricted under
subsection (4) –
(a)
the personal data shall, with the exception of storage,
only be processed with the data subject’s consent or for
the establishment, exercise or defence of a legal claim,
the protection of the rights of another person or for
reasons of public interest; and
(b)
the controller shall inform the data subject before lifting
the restriction on processing of the personal data.
(7) The controller shall implement mechanisms to ensure that
the time limits established for the rectification, erasure or restriction of
processing of personal data, or for a periodic review of the need for the
storage of the personal data, are observed.
40.
Right to object
(1) The data subject shall have the right to object in writing at
any time to the processing of personal data concerning him unless the
controller demonstrates compelling legitimate grounds for the processing
which override the data subject’s interests, rights and freedoms or for the
establishment, exercise or defence of a legal claim.
(2) Where personal data are processed for the purpose of direct
marketing, the data subject may object to processing of personal data
concerning him for such marketing, which includes profiling to the extent
that it is related to such direct marketing.
(3) Where a data subject objects to processing of personal data
for the purpose of direct marketing, the personal data shall no longer be
processed for that purpose.