23
2019
Data Protection
No.
(c) processing is unlawful and the data subject
opposes the erasure of the personal data and
requests the restriction of their use instead; or
(d) data subject has objected to the processing,
pending verification as to whether the legitimate
interests of the data controller or data processor
overrides those of the data subject.
(2) Where processing of personal data is restricted
under this section—
(a) the personal data shall, unless the data is being
stored, only be processed with the data subject’s
consent or for the establishment, exercise or
defence of a legal claim, the protection of the
rights of another person or for reasons of public
interest; and
(b) the data controller shall inform the data subject
before withdrawing the restriction on processing of
the personal data.
(3) The data controller or data processor shall
implement mechanisms to ensure that time limits
established for the rectification, erasure or restriction of
processing of personal data, or for a periodic review of the
need for the storage of the personal data, is observed.
35. (1) Every data subject has a right not to be subject
to a decision based solely on automated processing,
including profiling, which produces legal effects
concerning or significantly affects the data subject.
(2) Sub-section (1) shall not apply where the decision
is—
(a) necessary for entering into, or performing, a
contract between the data subject and a data
controller;
(b) authorised by a law to which the data controller is
subject and which lays down suitable measures to
safeguard the data subject’s rights, freedoms and
legitimate interests; or
(c) based on the data subject’s consent.
(3) Where a data controller or data processor takes a
decision, which produces legal effects or significantly
Automated
individual
decision making.
!