Facts
In Austria, a mobile phone operator refused to conclude a contract with a customer, which would have involved a monthly payment of EUR 10, on the ground that her credit standing was insufficient. The operator relied on an automated assessment carried out by Dun & Bradstreet Austria, a company that provides such assessments. An Austrian court found by final decision that Dun & Bradstreet had breached the General Data Protection Regulation (GDPR) by failing to give the customer meaningful information about the logic involved. The enforcement authority, the Magistrat der Stadt Wien (Vienna City Administration), refused her application to enforce that decision. Hearing her appeal against that refusal, the Administrative Court of Vienna asked the Court of Justice of the EU (CJEU) what the company had to do in practice.
Question
The case concerned the right of access in Article 15(1)(h) GDPR, which covers 'meaningful information about the logic involved' in automated decision-making, including profiling. The referring court asked how detailed that information must be, whether the controller may withhold it by relying on its own or third parties' trade secrets under Directive 2016/943, and whether an Austrian provision that, as a rule, excludes access where a trade secret would be compromised is compatible with the GDPR.
Decision
The Court held that the controller must describe the procedure and principles actually applied in such a way that the data subject can understand which personal data were used and how. It may be appropriate to indicate how far a variation in the data taken into account would have led to a different result. By contrast, merely communicating an algorithm is not a sufficiently concise and intelligible explanation. Where the controller considers that the information includes trade secrets or third-party data, it must provide that information to the competent supervisory authority or court, which then balances the rights at stake. A national rule excluding access as a rule in such cases is precluded.
Why it matters
The ruling gives concrete content to the debate on a 'right to explanation'. Controllers that use scoring or other automated systems must be able to explain the decisive factors in terms the individual can understand and use to contest the decision, and confidentiality cannot serve as a blanket defence. Read together with SCHUFA, it clarifies both when Article 22 is engaged and what level of transparency is owed once it is.