Data Protection [No. 3 of 2021 119 (5) A data controller shall on the first communication with the data subject, expressly bring the rights of the data subject to the attention of the data subject and present the information clearly and separately from any other information. 62. (1) A data subject shall not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning that data subject or similarly affects that data subject. Decision taken on basis of automatic data processing (2) Subsection (1) shall not apply if the decision is— (a) necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) authorised by any written law; or (c) based on the data subject’s explicit consent. (3) A data controller shall, in cases under subsection (2), implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, including the right to obtain human intervention on the part of the data controller for purposes of enabling the data subject to express the data subject’s point of view and contest the decision. (4) Automated data processing shall not be undertaken where the processing involves sensitive personal data unless— (a) the data subject has expressly consented to that processing; (b) the processing is in the public interest; or (c) the processing is permitted by any written law and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. 63. (1) A data subject may restrict a data controller from processing that data subject’s personal data where the— (a) accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the personal data; (b) data controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims; (c) data subject has objected to processing pursuant to section 60(1)(c) pending the verification whether the legitimate grounds of the data controller override those ofthe data subject. Right to restriction of processing