The Data Protection Act And Data Processing
Under Article 22 of the UK GDPR, an organisation is required to ensure that no decisions are made solely on the basis of automatic data processing. If that does happen, then they have to notify you of the fact as soon as possible.
However, be aware that there are some situations where Article 22 doesn't apply. An organisation is allowed to make decisions on such as basis if they're for the purpose of deciding whether to enter into a contract with you, in the course of performing the contract, and if the effect of the decision is to grant a request you've made (which is acceptable as long as they've taken steps to safeguard your interests, for example, by allowing you to make representations).

Find out your legal rights on a faulty product in less than a minute.
Try our Faulty Goods Rights Checker free, here on this site →How To Prevent Decisions Based On Automatic Data Processing
A number of decisions about you are made on the basis of automatically data processing, such as your performance at work, you reliability, even your creditworthiness. These are all things that can have a huge effect on your life.
If you want to prevent decisions about you (other than those that are exempt) on the basis of automatic data processing, you can send a notice to the organisation to ensure this doesn't happen. It might relate to a specific decision or be in regard to decisions to be taken by the organisation about you.
There's no special form the notice needs to take. You must make your identity clear, and explain the decision that concerns you. It does, however, need to be in writing and dated. It doesn't need to be on paper (although if you're posting, send by recorded delivery); electronic communication is acceptable, as long as you can be properly identified. Keep a copy of the notice and all subsequent correspondence. Your notice doesn't have to be addressed to a specific individual - to the Company Secretary is fine.
Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.
If You've Been A Victim Of Automatic Data Processing
If you receive notification from an organisation that a decision about you has been made solely on the basis of automatic data processing, and you're not happy with that decision, you have 21 days to serve a "data subject notice" on the organisation requiring them to either reconsider the decision, or take a new one based on different data.
You need to identify yourself, and the decision to which you're referring, and you must be explicit in your request to reconsideration or a new decision based on other data. The notice must be in the form of a letter, either or paper or electronically sent. Keep a copy of it and any other correspondence; it might be evidence if you need to go to court over the matter.
With 21 days of receipt of your letter, the organisation must give you a written reply, stating what they will do to comply with the data subject notice. If you're still not happy with their response, you can ask the Information Commissioner (https://ico.org.uk/) to make an assessment as to whether it's likely or not that the organisation is in compliance with the Data Protection Act. You can also take the organisation to court.
Court Decisions About Data Protection
It's not necessary to consult the Information Commissioner before going to court, nor does his assessment hold any weight with a judge.
If a court believes that an organisation didn't comply with a data subject notice, an order may be given for them to reconsider their decision, or take a new one that isn't based purely on automatically data processing. Furthermore, if the court believes you've suffered damage because of the organisation's actions, they may award compensation. Should they believe, in respect of the data, that there is a strong risk of further contravention, they may order erasure, destruction or blocking of the data.
1 – Delays in meeting the 30 day limit on responding
2 – Failure to notify me of the delay as required.
3 – Disclosing potentially sensitive information to an address used in a fraudulent order (at least twice) despite specific instructions to the contrary.
4 – Not advising me that they had disclosed the information to the wrong address once this was pointed out by both me (first time) and the ICO (second instance).
5 – I have not had any apology.
I wish to claim compensation for the distress cause but do not know how much is reasonable to claim, and thus if the company involved makes me an offer, if it is reasonable. Are there any guidelines available to me and do you have any advise on whether to use a solicitor or small claims court.
Ask Consumer Rights Expert a question
Ask our editorial team a question and we will reply with our advice. Tell us as much about your situation as you can: the more detail you give, the more useful our answer can be.
You do not need to use your real name. Please do not include your full address, phone number, email address, or the names of other people. We may edit or remove identifying details for privacy and legal reasons.
Comments are moderated before publication.