Article 22

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or that similarly significantly affects them, unless such processing:

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

7a. In Article 22, paragraph 3 is replaced by the following:

3. In the cases referred to in points (a) and (c) of paragraph 21, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contestchallenge the decision taken in respect of them. Meaningful human intervention on the part of the controller requires that the human reviewer has the authority, knowledge, and competence to modify the contested decision, and that they actively analyse all relevant data, not merely the output of the system.