Regulation 34 Automated individual decisions

A decision which produces an adverse legal effect for the data subject or significantly affects them and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to the data subject shall be permitted where it aids the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

A UK competent authority which proposes to make a decision permitted by paragraph (1) must take steps to safeguard the legitimate interests of the data subject (for example, by allowing them to make representations).