23 2019 Data Protection No. (c) processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; or (d) data subject has objected to the processing, pending verification as to whether the legitimate interests of the data controller or data processor overrides those of the data subject. (2) Where processing of personal data is restricted under this section— (a) the personal data shall, unless the data is being stored, only be processed with the data subject’s consent or for the establishment, exercise or defence of a legal claim, the protection of the rights of another person or for reasons of public interest; and (b) the data controller shall inform the data subject before withdrawing the restriction on processing of the personal data. (3) The data controller or data processor shall implement mechanisms to ensure that time limits established for the rectification, erasure or restriction of processing of personal data, or for a periodic review of the need for the storage of the personal data, is observed. 35. (1) Every data subject has a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning or significantly affects the data subject. (2) Sub-section (1) shall not apply where the decision is— (a) necessary for entering into, or performing, a contract between the data subject and a data controller; (b) authorised by a law to which the data controller is subject and which lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or (c) based on the data subject’s consent. (3) Where a data controller or data processor takes a decision, which produces legal effects or significantly Automated individual decision making. !