Section 97 — Data Protection Act 2018: Right to intervene in automated decision-making

Right to intervene in automated decision-making 97 1 This section applies where—

a the controller takes a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject, and b the decision is required or authorised by law.

2 This section does not apply to such a decision if—

a the data subject has given consent to the decision being made on that basis, or b the decision is a decision taken in the course of steps taken—

i for the purpose of considering whether to enter into a contract with the data subject, ii with a view to entering into such a contract, or iii in the course of performing such a contract.

3 The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.

4 The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—

a to reconsider the decision, or b to take a new decision that is not based on entirely automated processing.

5 If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—

a consider the request, including any information provided by the data subject that is relevant to it, and b by notice in writing inform the data subject of the outcome of that consideration. 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .