6B.—(1) Subject to subsection (2) of this section, a decision which produces legal effects concerning a data subject or otherwise significantly affects a data subject may not be based solely on processing by automatic means of personal data in respect of which he or she is the data subject and which is intended to evaluate certain personal matters relating to him or her such as, for example (but without prejudice to the generality of the foregoing), his or her performance at work, creditworthiness, reliability or conduct.

(2) Subsection (1) of this section does not apply—

(a) in a case in which a decision referred to in that subsection—

(i) is made in the course of steps taken—

(I) for the purpose of considering whether to enter into a contract with the data subject,

(II) with a view to entering into such a contract, or

(III) in the course of performing such a contract,

or

(ii) is authorised or required by any enactment and the data subject has been informed of the proposal to make the decision, and

(iii) either—

(I) the effect of the decision is to grant a request of the data subject, or

(II) adequate steps have been taken to safeguard the legitimate interests of the data subject by, for example (but without prejudice to the generality of the foregoing), the making of arrangements to enable him or her to make representations to the data controller in relation to the proposal,

or

(b) if the data subject consents to the processing referred to in subsection (1).]