Section 96 — Data Protection Act 2018: Right not to be subject to automated decision-making

Right not to be subject to automated decision-making 96 1 The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject.

2 Subsection (1) does not prevent such a decision being made on that basis if—

a the decision is required or authorised by law, b the data subject has given consent to the decision being made on that basis, or c the decision is a decision taken in the course of steps taken—

i for the purpose of considering whether to enter into a contract with the data subject, ii with a view to entering into such a contract, or iii in the course of performing such a contract.

3 For the purposes of this section and section 97 , a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.

4 For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.