PART 3Law enforcement processing
CHAPTER 3Rights of the data subject
Automated individual decision-making
49Right not to be subject to automated decision-making
1
A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.
2
A decision is a “significant decision” for the purpose of this section if, in relation to a data subject, it—
a
produces an adverse legal effect concerning the data subject, or
b
significantly affects the data subject.
50Automated decision-making authorised by law: safeguards
1
A decision is a “qualifying significant decision” for the purposes of this section if—
a
it is a significant decision in relation to a data subject, and
b
it is required or authorised by law.
2
Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
a
the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
b
the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
i
reconsider the decision, or
ii
take a new decision that is not based solely on automated processing.
3
If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request—
a
consider the request, including any information provided by the data subject that is relevant to it,
b
comply with the request, and
c
by notice in writing inform the data subject of—
i
the steps taken to comply with the request, and
ii
the outcome of complying with the request.
4
The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject’s rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
5
Regulations under subsection (4)—
a
may amend this section, and
b
are subject to the affirmative resolution procedure.
6
In this section “significant decision” has the meaning given by section 49(2).