!
24
Data Protection
No.
2019
affects the data subject based solely on automated
processing—
(a) the data controller or data processor must, as soon
as reasonably practicable, notify the data subject in
writing that a decision has been taken based solely
on automated processing; and
(b) the data subject may, after a reasonable period of
receipt of the notification, request the data
controller or data processor to—
(i)
reconsider the decision; or
(ii) take a new decision that is not based solely on
automated processing.
(4) A data controller or data processor, upon receipt
of a request under sub-section (3), shall within a reasonable
period of time—
(a) consider the request, including any information
provided by the data subject that is relevant to it;
(b) comply with the request; and
(c) by notice in writing inform the data subject of—
(i) the steps taken to comply with the request; and
(ii) the outcome of complying with the request.
(5) The Cabinet Secretary may by Regulations make
such further provision to provide suitable measures to
safeguard a data subject’s rights, freedoms and legitimate
interests in connection with the taking of decisions based
solely on automated processing.
36. A data subject has a right to object to the
processing of their personal data, unless the data controller
or data processor demonstrates compelling legitimate
interest for the processing which overrides the data
subject’s interests, or for the establishment, exercise or
defence of a legal claim.
Objecting to
processing.
37. (1) A person shall not use, for commercial
purposes, personal data obtained pursuant to the provisions
of this Act unless the person—
Commercial use
of data.
(a) has sought and obtained express consent from a
data subject; or