(1) This section applies where -
(a) the controller takes a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject, and
(b) the decision is required or authorised by law.
(2) This section does not apply to such a decision if -
(a) the data subject has given consent to the decision being made on that basis, or
(b) the decision is a decision taken in the course of steps taken -
(i) for the purpose of considering whether to enter into a contract with the data subject,
(ii) with a view to entering into such a contract, or
(iii) in the course of performing such a contract.
(3) The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.
(4) The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller -
(a) to reconsider the decision, or
(b) to take a new decision that is not based solely o
…