PART 4Intelligence services processing
CHAPTER 3Rights of the data subject
Rights
97Right to intervene in automated decision-making
1
This section applies where—
a
the controller takes a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject, and
b
the decision is required or authorised by law.
2
This section does not apply to such a decision if—
a
the data subject has given consent to the decision being made on that basis, or
b
the decision is a decision taken in the course of steps taken—
i
for the purpose of considering whether to enter into a contract with the data subject,
ii
with a view to entering into such a contract, or
iii
in the course of performing such a contract.
3
The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.
4
The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—
a
to reconsider the decision, or
b
to take a new decision that is not based solely on automated processing.
5
If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—
a
consider the request, including any information provided by the data subject that is relevant to it, and
b
by notice in writing inform the data subject of the outcome of that consideration.
6
For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.