Legitimate interests objection-handling procedure

This procedure applies where the school processes personal information on the basis of legitimate interests, including where direct marketing is undertaken. It is conditional on the school using legitimate interests as the basis for the relevant processing.

Responsibility

The [legitimate interests owner role] is responsible for managing objections under this procedure, recording the decision and communicating the outcome.

Receiving an objection

Record each objection when it is received, including the person’s objection, the processing purpose concerned and whether the processing includes direct marketing.

Assess the objection against the purpose of the processing and the school’s use of legitimate interests as the relevant basis.

Objection to direct marketing

Where a person objects to the use of their information for direct marketing, stop using their information for direct marketing.

Record the action taken to stop the direct-marketing processing and retain the record with the objection and response.

Objection relating to another purpose

Where the objection concerns processing for another purpose, stop the processing unless the school can show compelling legitimate grounds that override the person’s rights.

Where processing is to continue, document the compelling legitimate grounds relied upon and how those grounds override the person’s rights. Where compelling legitimate grounds cannot be shown, stop the processing.

Recording and communicating the outcome

Record the decision, the purpose concerned, the action taken and, where processing continues for a purpose other than direct marketing, the compelling legitimate grounds relied upon.

Communicate the outcome to the person, including whether the relevant processing has stopped or, for a purpose other than direct marketing, the compelling legitimate grounds relied upon for continuing it.