Data Protection No. 24 of 2019 [Subsidiary] (2) A data controller or data processor shall determine the purpose and means of sharing personal data from one data controller or data processor to another. (3) Data sharing outlined under this regulation may include— (a) providing personal data to a third party by whatever means by the data controller or data processor; (b) receiving personal data from a data controller or data processor as joint participant in a data sharing arrangement; (c) exchanging or transmission of personal data; (d) providing third party with access to personal data on the data controller’s information systems; (e) separate or joint initiatives by data controllers or data processors to pool personal data making the data available to each other or a third-party subject to entering into an agreement, as may be applicable; or (f) routine data sharing between data controllers on a regular or pre-planned basis. (4) In carrying out any routine data sharing as contemplated under paragraph (3)(f), a data controller shall enter into agreements prior to data sharing. (5) For the avoidance of doubt, the sharing of data within the organizational structures of a data controller or data processor is not considered as a data sharing. (6) A request for sharing personal data under this regulation shall be in writing, and shall specify— (a) the purpose for which personal data is required; (b) the duration for which personal data shall be retained; and (c) proof of the safeguards put in place to secure personal data from unlawful disclosure. 22. Automated individual decision making (1) In this regulation— “an automated individual decision-making” means a decision made by automated means without any human involvement. (2) Pursuant to section 35 of the Act, a data controller or data processor shall— (a) inform a data subject when engaging in processing based on automated individual decision making; (b) provide meaningful information about the logic involved; (c) ensure— (i) specific transparency and fairness requirements are in place; (ii) rights for a data subject to oppose profiling and specifically profiling for marketing are present; and (iii) where conditions specified under section 31 of the Act arise, a data protection impact assessment is carried out; (d) explain the significance and envisaged consequences of the processing; (e) ensure the prevention of errors; (f) use appropriate mathematical or statistical procedures; (g) put appropriate technical and organisational measures in place to correct inaccuracies and minimise the risk of errors; (h) process personal data in a way that eliminates discriminatory effects and bias; and (i) ensure that a data subject can obtain human intervention and express their point of view. 27