(1) A decision based solely on automated processing which produces an adverse legal effect concerning the data subject or significantly affects him or her shall be permitted only when authorized by law.
(2) Decisions referred to in subsection 1 shall not be based on special categories of personal data unless suitable measures to safeguard the data subject’s legally protected and legitimate interests are in place.
(3) Profiling that results in discrimination against natural persons on the basis of special categories of personal data shall be prohibited.
