! 24 Data Protection No. 2019 affects the data subject based solely on automated processing— (a) the data controller or data processor must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing; and (b) the data subject may, after a reasonable period of receipt of the notification, request the data controller or data processor to— (i) reconsider the decision; or (ii) take a new decision that is not based solely on automated processing. (4) A data controller or data processor, upon receipt of a request under sub-section (3), shall within a reasonable period of time— (a) consider the request, including any information provided by the data subject that is relevant to it; (b) comply with the request; and (c) by notice in writing inform the data subject of— (i) the steps taken to comply with the request; and (ii) the outcome of complying with the request. (5) The Cabinet Secretary may by Regulations make such further provision to provide suitable measures to safeguard a data subject’s rights, freedoms and legitimate interests in connection with the taking of decisions based solely on automated processing. 36. A data subject has a right to object to the processing of their personal data, unless the data controller or data processor demonstrates compelling legitimate interest for the processing which overrides the data subject’s interests, or for the establishment, exercise or defence of a legal claim. Objecting to processing. 37. (1) A person shall not use, for commercial purposes, personal data obtained pursuant to the provisions of this Act unless the person— Commercial use of data. (a) has sought and obtained express consent from a data subject; or