1 The controller shall inform the data subject about any decision that is based exclusively on automated processing and that has a legal consequence for or a considerable adverse effect on the data subject (automated individual decision).
2 It shall on request allow the data subject to express their point of view. The data subject may request that the automated individual decision be reviewed by a natural person.
3 Paragraphs 1 and 2 do not apply if:
- a.
the automated individual decision is directly connected with the conclusion or the processing of a contract between the controller and the data subject and the data subject's request is granted; or
- b.
the data subject has explicitly consented to the decision being automated.
4 If the automated individual decision is issued by a federal body, it must designate the decision accordingly. Paragraph 2 does not apply if, in accordance with Article 30 paragraph 2 of the Administrative Procedure Act of 20 December 1968 (APA) or another federal act, the data subject is not entitled to a hearing before the decision is taken.