(1) This section makes provision for the purposes of Article 22(2)(b) of the UK GDPR (exception from Article 22(1) of the UK GDPR for significant decisions based solely on automated processing that are authorised by law and subject to safeguards for the data subject's rights, freedoms and legitimate interests).
(2) A decision is a "significant decision" for the purposes of this section if, in relation to a data subject, it -
(a) produces legal effects concerning the data subject, or
(b) similarly significantly affects the data subject.
(3) A decision is a "qualifying significant decision" for the purposes of this section if -
(a) it is a significant decision in relation to a data subject,
(b) it is required or authorised by law, and
(c) it does not fall within Article 22(2)(a) or (c) of the UK GDPR (decisions necessary to a contract or made with the data subject's consent).
(4) Where a controller takes a qualifying significant decision in relation to a data subject based solely on auto
…