Acts 2017 (i) 503 appropriate safeguards taken under section 36, in case the personal data are transferred or intended to be transferred to another country. (3) The controller shall provide the information referred to in subsection (2) in an intelligible form, using clear and plain language. (4) Where the personal data are not or have not been collected from the data subject, the controller shall not be required to provide information where the processing is expressly prescribed by law or this proves to be impossible or involves a disproportionate effort. (5) (a) The controller shall, within one month of the receipt of a request, inform the data subject in writing, whether or not any action has been taken pursuant to subsection (1). (b) The period specified in paragraph (a) may be extended by a further month where necessary, taking into account the complexity and the number of requests made. (6) Where a controller refuses to take action on the request of a data subject, he or it shall, within one month of the receipt of the request, inform the data subject in writing of the reason for the refusal and on the possibility of lodging a complaint with the Commissioner. (7) (a) Where the request is manifestly excessive, the controller may charge a fee for providing the information or taking the action requested, or he or it may not take the action requested. (b) Where the controller takes a decision under paragraph (a), he or it shall bear the burden of proving the manifestly excessive character of the request. 38. Automated individual decision making (1) Every data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or significantly affects him.