The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject.
Subsection (1) does not prevent such a decision being made on that basis if—
the decision is required or authorised by law,
the data subject has given consent to the decision being made on that basis, or
the decision is a decision taken in the course of steps taken—
for the purpose of considering whether to enter into a contract with the data subject,
with a view to entering into such a contract, or
in the course of performing such a contract.
For the purposes of this section and section 97, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.