Personal Data Protection and Privacy: Your Right to Object

What is Article 19 'Right to Object?'

The right to object, which is referenced from Rwanda’s law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, is the data subject’s ability to object to processing of personal data at any time.

This means that a data subject can stop data processors and data controllers from using his/her data, as long as this objection follows certain circumstances stated within the law.

When can a data subject object?

As stated in the law on personal data protection and privacy, a data subject can object to personal data processing due to the following circumstances:

  • Processing of personal data is likely to cause loss, sadness or anxiety to the data subject;
  • Personal data are processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

Can a request to stop personal data processing be rejected?

Yes. If the data processor or data controller which processes said personal data can demonstrate compelling legitimate grounds for the personnel data processing, the right to object does not apply.

As stated within the law, these compelling legitimate grounds must override the interests, rights and freedoms of the data subject or for the establishment of the legal claim.

How does a data subject exercise their right to object?

  • The data subject, at any time in writing or electronically, contacts the data controller or data processor to request the ceasing of processing of personal data.
  • The data controller or the data processor, within thirty (30) days from the date of receipt of the request, must inform the concerned data subject in writing or electronically of the compliance with the request or reasons for non-compliance.

Additionally:

  1. The data subject who is not satisfied with the response of the data controller or the data processor may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.
  2. If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.

For any further information, please contact the Data Protection & Privacy Office through toll-free number 9080, or through email at dpp@dpo.gov.rw.