(1) A decision is a "qualifying significant decision" for the purposes of this section if -
(a) it is a significant decision in relation to a data subject, and
(b) it is required or authorised by law.
(2) Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing -
(a) the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
(b) the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to -
(i) reconsider the decision, or
(ii) take a new decision that is not based solely on automated processing.
(3) If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request -
(a) consider the request, including any information provided by the data subject that is r
…