PART 4Intelligence services processing

CHAPTER 3Rights of the data subject

Rights

96Right not to be subject to automated decision-making

1

The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject.

2

Subsection (1) does not prevent such a decision being made on that basis if—

a

the decision is required or authorised by law,

b

the data subject has given consent to the decision being made on that basis, or

c

the decision is a decision taken in the course of steps taken—

i

for the purpose of considering whether to enter into a contract with the data subject,

ii

with a view to entering into such a contract, or

iii

in the course of performing such a contract.

3

For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.