89. (1) Subject to subsection (2), a decision that produces an adverse legal effect for a data subject or significantly affects a data subject shall not be based solely on automated processing, including profiling, of personal data that relate to him or her.

(2) Subsection (1) shall not apply where—

(a) the taking of a decision based solely on automated processing is authorised by the law of the European Union or the law of the State and the law so authorising contains appropriate safeguards for the rights and freedoms of the data subject, including the right of the data subject to make representations to the controller in relation to the decision, and

(b) the controller has taken adequate steps to safeguard the legitimate interests of the data subject.

(3) Profiling that results in discrimination against an individual on the basis of a special category of personal data shall be prohibited.