Section 38: Automated individual decision making
as enacted (not consolidated). juris shows this Act from a copy that is not the official consolidation, so it may not carry every amendment; the amendments juris holds are listed. It does not confirm that this is the law in force today.
38. Automated individual decision making
(1) Every data subject shall have the right not to be subject to a
decision based solely on automated processing, including profiling, which
produces legal effects concerning him or significantly affects him.
504 Acts 2017 Acts 2017 505
(2) Subsection (1) shall not apply where the decision is –
(a) necessary for entering into, or performing, a contract
between the data subject and a controller;
(b) authorised by a law to which the controller is subject and
which lays down suitable measures to safeguard the data
subject’s rights, freedoms and legitimate interests; or
(c) based on the data subject’s explicit consent.
(3) Any automated processing of personal data intended to
evaluate certain personal aspects relating to an individual shall not be
based on special categories of personal data.
(4) In the cases referred to in subsection (2), the information to
be provided by the controller under section 23 shall include information
as to the existence of processing for a decision of the kind referred to in
subsection (1) and the envisaged effects of such processing on the data subject.
(5) In the cases referred to in subsection (2)(a) or (c), the controller
shall implement suitable measures to safeguard the data subject’s rights,
freedoms and legitimate interests.