PART 4Intelligence services processing
CHAPTER 3Rights of the data subject
Rights
96Right not to be subject to automated decision-making
1
The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject.
2
Subsection (1) does not prevent such a decision being made on that basis if—
a
the decision is required or authorised by law,
b
the data subject has given consent to the decision being made on that basis, or
c
the decision is a decision taken in the course of steps taken—
i
for the purpose of considering whether to enter into a contract with the data subject,
ii
with a view to entering into such a contract, or
iii
in the course of performing such a contract.
3
For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.