Mr. Dale Sunderland:

There is a right to object to processing. In the absence of legislation, the balancing test under Article 15.4 would still have to be carried out but it would be done absent of any legislative framework or any reference to such a framework. Each controller would have to do it individually, which may give rise to nuances and inconsistencies in terms of how each controller sees their obligations and their understanding of the rights of the various parties. It is also the case that any restriction of rights by a data controller needs to be set down in law so any potential restriction of the right to processing on behalf of a data subject that the controller wishes to implement would have to be done through some other legislative means. It is complex and is not completely clear cut because many aspects of the GDPR come into play, depending on the lawful basis that is being relied on for the processing. Processing in the public interest is probably the context here. Setting it out in law sets out the public interest to be achieved by the restriction. Generally, it is always more advantageous that all of the issues are set out in primary legislation under one Bill rather than having disparate pieces. Obviously, however, Article 15 stands on its own and will continue to stand. Any restrictions that the Bill might bring forward will have to be done in that context. EU law, and its primacy, still stands and the Bill cannot run contrary to it. Policymakers and the Legislature have to ensure that what is in the Bill respects EU law and from what we have seen so far, that is certainly what they are trying to achieve here.