Acts 2017 504 (2) Subsection (1) shall not apply where the decision is – (a) necessary for entering into, or performing, a contract between the data subject and a controller; (b) authorised by a law to which the controller is subject and which lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or (c) based on the data subject’s explicit consent. (3) Any automated processing of personal data intended to evaluate certain personal aspects relating to an individual shall not be based on special categories of personal data. (4) In the cases referred to in subsection (2), the information to be provided by the controller under section 23 shall include information as to the existence of processing for a decision of the kind referred to in subsection (1) and the envisaged effects of such processing on the data subject. (5) In the cases referred to in subsection (2)(a) or (c), the controller shall implement suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests. 39. Rectification, erasure or restriction of processing (1) (a) A controller shall, on being informed of the inaccuracy of personal data by a data subject to whom such data pertains, cause the data to be rectified without undue delay. (b) A right to rectification under paragraph (a) shall include the right of a data subject to have incomplete personal data completed, having regard to the purpose of the processing. (2) where – A controller shall erase personal data without undue delay (a) the data are no longer necessary in relation to the purpose for which they were collected or otherwise processed;