(3) Where the Commission is satisfied on a complaint by a person who
has given notice in subsection (1), that the data controller has failed to comply
with the notice, the Commission may order that data controller to comply with
the notice.
(4) In this section “direct marketing” includes the communication by
whatever means of any advertising or marketing material which is directed to
particular individuals.
Rights in relation to automated decision-taking
41. (1) An individual is entitled at any time by notice in writing to a
data controller to require the data controller to ensure that any decision
taken by or on behalf of the data controller which significantly affects
that individual is not based solely on the processing by automatic means
of personal data in respect of which that individual is the data subject.
(2) Despite the absence of a notice, where a decision which
significantly affects an individual is based solely on that processing
(a) the data controller shall as soon as reasonably practicable notify
the individual that the decision was taken on that basis, and
(b) the individual is entitled, by notice in writing to require the data
controller to reconsider the decision within twenty-one days after
receipt of the notification from the data controller.
(3) The data controller shall within twenty-one days after receipt of the
notice, inform the individual in writing of the steps that the data controller
intends to take to comply with the notice.
(4) This section does not apply to a decision made
(a) in the course of considering whether to enter into a contract with the
data subject,
(b) with a view to entering into the contract,
(c) in the course of the performance of the contract,
(d) for a purpose authorised or required by or under an enactment, or
(e) in other circumstances prescribed by the Minister.
(5) Where the Commission is satisfied on a complaint by a data subject
that a person taking a decision has failed to comply, the Commis- sion may order
the data controller to comply.
(6) An order for compliance under subsection (5) shall not affect the rights
of a person other than the data subject or the data controller.
Rights in relation to exempt manual data
42. (1) A data subject is entitled at any time by notice in writing to
require a data controller
(a) to rectify, block, erase or destroy exempt manual data which is
inaccurate or incomplete, or
(b) to cease to hold exempt manual data in a manner which is