Right not to be subject to a decision based solely on automated processing

Data subjects have the right not to be subject to a decision based solely on automated processing of their data, including ‘profiling’, which produces legal effects concerning them or which affects them negatively, except where the decision:

• Is necessary for the entering or performance of a contract between the data subject and a controller.
• Is based on the explicit consent of the data subject.
• Is expressly authorised by a law of the Union or the corresponding Member State.