Acts 2017 506 (c) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; or (d) the data subject has objected to the processing pursuant to section 41 pending verification as to whether the legitimate grounds of the controller override those of the data subject. (6) Where processing of personal data is restricted under subsection (4) – (a) the personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of a legal claim, the protection of the rights of another person or for reasons of public interest; and (b) the controller shall inform the data subject before lifting the restriction on processing of the personal data. (7) The controller shall implement mechanisms to ensure that the time limits established for the rectification, erasure or restriction of processing of personal data, or for a periodic review of the need for the storage of the personal data, are observed. 40. Right to object (1) The data subject shall have the right to object in writing at any time to the processing of personal data concerning him unless the controller demonstrates compelling legitimate grounds for the processing which override the data subject’s interests, rights and freedoms or for the establishment, exercise or defence of a legal claim. (2) Where personal data are processed for the purpose of direct marketing, the data subject may object to processing of personal data concerning him for such marketing, which includes profiling to the extent that it is related to such direct marketing. (3) Where a data subject objects to processing of personal data for the purpose of direct marketing, the personal data shall no longer be processed for that purpose.