Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
based entirely or partly on personal data, and
based solely on automated processing,
the controller must ensure that safeguards for the data subject's rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).
The safeguards must consist of or include measures which—
provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;
enable the data subject to make representations about such decisions;
enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
enable the data subject to contest such decisions.
Subsections (1) and (2) do not apply in relation to a significant decision if—
exemption from those provisions is required for a reason listed in subsection (4),
the controller reconsiders the decision as soon as reasonably practicable, and
there is meaningful human involvement in the reconsideration of the decision.
Those reasons are—
to avoid obstructing an official or legal inquiry, investigation or procedure;
to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
to protect public security;
to safeguard national security;
to protect the rights and freedoms of others.
When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.