(1) The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject.
(2) Subsection (1) does not prevent such a decision being made on that basis if -
(a) the decision is required or authorised by law,
(b) the data subject has given consent to the decision being made on that basis, or
(c) the decision is a decision taken in the course of steps taken -
(i) for the purpose of considering whether to enter into a contract with the data subject,
(ii) with a view to entering into such a contract, or
(iii) in the course of performing such a contract.
(3) For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.