[2003.] Data Protection (Amendment) Act 2003. [No. 6.] (a) stating that he or she has complied or S.8 intends to comply with the request concerned, or (b) stating that he or she is of opinion that the request is unjustified to any extent and the reasons for the opinion and the extent (if any) to which he or she has complied or intends to comply with it. (5) If the Commissioner is satisfied, on the application to him or her in that behalf of an individual who has served a notice under subsection (1) of this section that appears to the Commissioner to be justified, or to be justified to any extent, that the data controller concerned has failed to comply with the notice or to comply with it to that extent and that not less than 40 days have elapsed since the receipt of the notice by him or her, the Commissioner may, by an enforcement notice served on the data controller, order him or her to take such steps for complying with the request, or for complying with it to that extent, as the Commissioner thinks fit and specifies in the enforcement notice, and that notice shall specify the reasons for the Commissioner being satisfied as aforesaid. Rights in relation to automated decision taking. 6B.—(1) Subject to subsection (2) of this section, a decision which produces legal effects concerning a data subject or otherwise significantly affects a data subject may not be based solely on processing by automatic means of personal data in respect of which he or she is the data subject and which is intended to evaluate certain personal matters relating to him or her such as, for example (but without prejudice to the generality of the foregoing), his or her performance at work, creditworthiness, reliability or conduct. (2) Subsection (1) of this section does not apply— (a) in a case in which a decision referred to in that subsection— (i) is made in the course of steps taken— (I) for the purpose of considering whether to enter into a contract with the data subject, (II) with a view to entering into such a contract, or (III) in the course of performing such a contract, or 23