(1) Subject to Article 22(4) and to suitable and specific measures to safeguard the fundamental rights and freedoms of the data subject, for the purposes of Article 22(2)(b), the right of a data subject not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her shall, in addition to the grounds identified in Article 22(2)(a) and (c), not apply where -

(a) the decision is authorised or required by or under an enactment, and

(b) either -

(i) the effect of that decision is to grant a request of the data subject, or

(ii) in all other cases (where subparagraph (i) is not applicable), adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject which steps shall include the making of arrangements to enable him or her to -

(I) make representations to the controller in relation to the decision,

(II) request human intervention in the decision-making process,

(III) request to appeal the decision.

(2) In the case of requests made under subsection (1)(b)(ii)(II) or (III) the controller shall -