Data Protection And Privacy Act
Act
2019
27. Rights in relation to automated decision-taking.
(1) A data subject may by notice in writing to a data controller
require the data controller to ensure that any decision taken by or on
behalf of the data controller which significantly affects that data
subject is not based solely on the processing by automatic means of
personal data in respect of that data subject.
(2) Without prejudice to subsection (1), where a decision which
significantly affects a data subject is based solely on automated
processmg (a) the data controller shall as soon as reasonably practicable
notify the data subject that the decision was taken on that
basis, and
(b) the data subject is entitled, by notice in writing to require
the data controller to reconsider the decision within twenty one days after receipt of the notification from the data
controller.
(3) The data controller shall within twenty-one days after receipt
of the notice, inform the data subject in writing of the steps that the
data controller has taken to take to comply with the notice.
(4) This section does not apply to a decision made(a)
in the course of considering whether to enter into a contract
with the data subject;
(b)
with a view to entering into the contract;
(c)
in the course of the performance of the contract; or
(d)
for a purpose authorised or required by or under any law
(5) Where the data subject is not satisfied with the decision of
the data controller in sub clause (3), the data subject shall complain
in writing to the Authority within fourteen days.