In the cases referred to in points a.) and c.) the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. Additional all decisions in all points referred to shall not be based on special categories of personal data referred to in Article 9(2)1), unless point (a) or (g) of Article 9(2) of the GDPR applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.