Automated individual decision-making, including profiling
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in any other way.
Paragraph 1 does not apply if the decision:
necessary for the establishment or performance of a contract between the data subject and a controller;
is permitted by a provision of Union or Member State law applicable to the controller which also provides for appropriate measures to protect the rights and freedoms and legitimate interests of the data subject; or
relies on the explicit consent of the data subject.
In the cases referred to in points (a) and (c) of paragraph 2, the controller shall implement appropriate measures to protect the rights and freedoms and legitimate interests of the data subject, including at least the right to human intervention by the controller, the right to express his or her point of view and the right to challenge the decision.
The decisions referred to in paragraph 2 shall not be based on the special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect the data subject's legitimate interests.
