(1) A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.
(2) A decision is a "significant decision" for the purpose of this section if, in relation to a data subject, it -
(a) produces an adverse legal effect concerning the data subject, or
(b) significantly affects the data subject.