VwGH (Austria) - Ro 2020/04/0010: Difference between revisions

Latest revision as of 14:57, 6 November 2025

VwGH - Ro 2020/04/0010

Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15(1)(h) GDPR Article 22 GDPR
Decided:	20.08.2025
Published:	07.10.2025
Parties:	Data Subject versus Dun & Bradstreet Austria GmbH
National Case Number/Name:	Ro 2020/04/0010
European Case Law Identifier:	ECLI:AT:VWGH:2025:RO2020040010.J00
Appeal from:	BVwG (Austria) Zl. W256 2217011-1/11E
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des bundes (RIS) (in German)
Initial Contributor:	Shravan

The Supreme Administrative Court held that a credit information agency violated Article 15(1)(h) GDPR by failing to provide meaningful information about the logic and weighting of factors in its automated credit scoring process. Further, the Court found that the existence of trade secrets could not justify the refusal to provide such information.

English Summary

Facts

The data subject submitted an access request under Article 15 GDPR to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed.

The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates.

The DSB partially upheld the complaint for violation of the right of access under Article 15 GDPR by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making.

The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated Article 15(1)(h) GDPR by not providing sufficient information about the logic of automated processing and weighting of factors.

The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in SCHUFA Holding (Germany) and Dun & Bradstreet Austria (Austria), which dealt with similar issues around credit scoring and automated processing under GDPR.

Holding

The Austrian Supreme Administrative Court (BVwG) dismissed the appeal.

Under Article 15(1)(h) GDPR, data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in Article 22(1) GDPR must exist.

The VwGH held that it was undisputed in this case that an automated decision, a credit score, had been made and the credit information agency violated the data subject’s right to receive meaningful information under Article 15(1)(h) GDPR, since the provided information was too vague, It did not explain the impact of specific data points on the score and it used general statements like without clarifying what this means or how it affected the result.

Under SCHUFA Holding & Dun & Bradstreet Austria meaningful information must be precise, transparent, understandable, easily accessible, and must allow the data subject to, understand how their data was used, know which data had which influence, and challenge the outcome.

Regarding the claim by the credit information agency that it couldn't disclose more details about how it calculated the individual’s score because the method was protected as a trade secret, the VwGH argued that the scoring method may indeed be a protected trade secret, however, the data subject has a strong right to understand the logic and influence of personal data in automated decision-making, especially because credit scores can significantly affect a person's economic life.

In this case, the credit information agency did not demonstrate that explaining which factors were used and how they influenced the score would necessarily reveal the secret formula.

Under relevant CJEU case law the GDPR rights are not absolute but the mere existence of a trade secret cannot justify a complete refusal to provide any access. A specific, balanced assessment must take place. Therefore, Article 15(1)(h) GDPR still applies even when trade secrets are involved.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Subject

The Administrative Court, represented by Senate President Dr. Pollak, Hofrat Dr. Mayr, Hofratin Mag. Hainz-Sator, and Hofrat Dr. Pürgy and Mag. Brandl as judges, with the assistance of Mag. Vonier, secretary, on the appeal by B GmbH, represented by Mag. Martin Dohnal, attorney-at-law in Vienna, against the decision of the Federal Administrative Court of October 23, 2019, Ref. No. W256 2217011-1/11E, concerning a data protection matter (authority sued before the Administrative Court: Data Protection Authority; co-participating party: GW, represented by Thurnher Wittwer Pfefferkorn & Partner Rechtsanwälte GmbH in Dornbirn; other party: Federal Minister of Justice), rightly ruled:

Ruling

The appeal is dismissed as unfounded.

The party seeking an appeal must reimburse the co-participant for expenses in the amount of €1,106.40 and the federal government for expenses in the amount of €553.20, each within two weeks, failing which the proceedings will be enforced.

Reasons

1 By decision of January 30, 2019, the Data Protection Authority partially upheld the complaint of the co-participants of November 23, 2016, alleging a violation of the right to information by the party appealing the appeal in the second legal process and found (point 1 of the decision) that the party appealing the appeal had violated the co-participants' fundamental right to data protection by "providing incomplete or incorrect information on the following points" in its information letter of January 20, 2017, including supplements dated April 26, 2017, July 12, 2018, and September 25, 2018, to the co-participants:

a) with regard to the categories of personal data being processed,

b) regarding the co-participants' creditworthiness data,

c) with regard to the weighting of the influencing factors, and

d) on the scope and intended effects of automated decision-making.

The Data Protection Authority otherwise dismissed the complaint (point 2 of the ruling) and ordered the party appealing the appeal to provide, within two weeks, "a data protection information that corrects the deficiencies identified under points 1.a., 1.b., 1.c., 1.d." (point 3 of the ruling).

2 The Administrative Court upheld the appeal filed by the party appealing the appeal with the contested decision with regard to points 1a, 1b, and 1d, and dismissed the appeal as unfounded in the remaining points (with regard to point 1c), so that points 1 and 3 of the contested decision should read:

"1a. The appeal is allowed and it is found that the respondent [party appealing the appeal] violated the appellant's [co-participant's] right to information by failing to provide it with meaningful information about the logic involved in automated decision-making concerning the appellant's data or by at least providing sufficient reasons why it cannot provide this information.

b. The remainder of the appeal is dismissed as unfounded.

3. The respondent is ordered to submit a decision with regard to point 1a within two weeks, failing which the appellant will be executed. to provide clarifying information."

The Administrative Court declared the appeal admissible.

3        The Administrative Court established the following undisputed facts:

Based on the request for information dated September 23, 2016, the party filing the appeal informed the co-participant that, for the purpose of providing credit information, it was processing the co-participant's name, address, date of birth, gender, socio-demographic data (number of household members, age, gross minimum household income), and data on the co-participant's payment method. Specifically, regarding the co-participant's payment method, the party filing the appeal stated that the co-participant's payment obligations to date had been met in accordance with the agreement, no current lawsuits or disputes had come to light, and a business relationship and appropriate credit were available. Furthermore, the party appealing the appeal pointed out that, because it had no negative entries regarding the co-participant, the assessment was based on automated calculation models, using the following "influencing factors" of a socio-demographic nature: "age, gender, residential situation, geography, local area information, no known negative characteristics."

In a letter dated April 26, 2017, the party appealing the appeal further informed the co-participant that the information regarding the payment method was derived from the fact that no negative data was known. The program logic of the party appealing the appeal is such that it stores socio-demographic data received from address publishers. It evaluates this data (name, date of birth, gender, place of residence, address) "according to its own procedure (trade secret)." This results in a baseline value, which is augmented by data from public records such as the commercial register, land register, trade register, and edict file. If necessary, the "score" is then generated using data from debt collection agencies, which can serve as a "decision-making aid for the authorized party to exclude the conclusion of a contract."

In a further letter dated July 12, 2018, the party filing the appeal supplemented its information regarding the specific automated decision-making process by stating that the "main influencing factors for calculating the score/rating" were: age, gender, living situation, company holdings (if any), education (academic degree), geographical information, and payment experience (if any). These factors are "compared with each other using a percentage method (where the key is a trade secret)." The resulting value is the "score" or "rating." Since no debt collection data was known about the co-participant, such data could not be included. The automated decision-making process therefore ended with the comparison.

Finally, the party appealing the appeal further supplemented its information on automated decision-making in a letter dated September 25, 2018. According to this, a "person scoring list" exists. This list contains the individual parameters for the respective score result. From this list, it can be seen that the basic data (sociodemographic data) forms the basis. These are each "equally stratified." The weighting of sociodemographic data is equal. In the event that "environmental data" is available, this "has an influence as a supplement to the sociodemographic data." The more such data is available, the more the sociodemographic data is "pushed back." Furthermore, the creditworthiness environment (positive payment experience data and negative characteristics) is included as a factor in the calculation. This creditworthiness context, in turn, displaces the environmental and socio-demographic data, "insofar as, for example, if negative characteristics are present, the socio-demographic data no longer influences the scoring value."

Regarding the "scope of the decision-making process," the party appealing the appeal pointed out that the data of the co-participants that influences the scoring value are solely socio-demographic data, i.e., their age, gender, place of residence, persons living in the household, and the type of building. Since neither environmental nor creditworthiness context data are known or stored, only the socio-demographic data of the co-participants were used for the "scoring value." These socio-demographic data are to be considered equal to one another. Based on her specified date of birth, the fact that she does not hold an academic title, her address is in the specified city, she lives in a two-family house with her husband, she has no known company investments, and there are no negative or positive payment experiences, the co-participant has "a rating in the best range of 2.6." Other factors were not considered in the decision.

Finally, regarding the "intended effect of the decision-making process," the party seeking the appeal pointed out that it operates a credit reporting agency. The "collection of data" serves "to make a decision about concluding a contract with the data subject."

The party seeking the appeal submitted the figure "Personal Score." This figure provides a general overview of the individual factors used to calculate the "score." Among other things, it states that "creditworthiness data" includes, among other things, "positive payment experiences: no payment defaults, positive results from research," and that socio-demographic data includes, among other things, "residential environment data."

4 From a legal perspective, the Administrative Court essentially assessed the established facts as follows: pursuant to Section 69 (4) of the Data Protection Act (DSG), the provisions of the GDPR and the DSG apply to the present proceedings.

In this case, the party filing the appeal, acting as a credit agency, processed personal data from the co-participant, which it automatically evaluated to assess the co-participant's financial situation and thus for the purpose of creating a decision-making aid for concluding a contract ("score") for third parties. Therefore, due to the co-participant's request for information, the party filing the appeal is obligated to provide the co-participant with information in accordance with Article 15 (1) (h) GDPR. The party seeking the appeal failed to fully comply with this requirement. In this case, the party seeking the appeal, as a credit agency, processed personal data from the co-participant, which it automatically evaluated to assess the co-participant's financial situation and thus for the purpose of creating a decision-making aid for concluding a contract ("score") for third parties. Therefore, based on the co-participant's request for information, the party seeking the appeal is obligated to provide the co-participant with information in accordance with Article 15, paragraph 1, letter h, GDPR. The party seeking the appeal failed to fully comply with this requirement.

Article 15(1)(h) GDPR, in accordance with the principle of fair and transparent processing, requires meaningful information about the logic of automated decision-making, at least in cases where – as in the present case – the processing is based on profiling. This should enable the data subject to understand the calculation process used in the automated decision-making process and thus be able to estimate and verify the result of this calculation for themselves. Article 15(1)(h) GDPR, in accordance with the principle of fair and transparent processing, requires meaningful information about the logic used in automated decision-making, at least in cases where – as in the present case – the processing is based on profiling. This is intended – as can be seen in particular from Recital 63 of the GDPR – to enable the data subject to understand the calculation process of the automated decision-making process and thus to be able to estimate and verify the result of this calculation for themselves.

In the present case, the party appealing the appeal did inform the co-participant that it had compared certain detailed data of the co-participants "equally" and thus arrived at a "score in the best range of 2.6." However, other meaningful information that could have provided suitable insight into the determination of this value was lacking. This deprived the co-participant of the opportunity to understand how the creditworthiness value assigned to it by the party appealing the appeal based on automated decision-making was determined, and thus of being able to understand this value itself. The information therefore remained inadequate with regard to the weighting of the influencing factors and thus with regard to its logic (point 1.c. of the decision of the data protection authority). The merely general statement by the party filing the appeal that the specific procedure was subject to trade secrets could not change this. The party filing the appeal would have had to specifically explain why the provision of meaningful information about the logic involved in automated decision-making would specifically constitute a trade secret.

In contrast, the party filing the appeal had sufficiently and clearly informed the other party about the scope and intended effects of automated decision-making (point 1.d. of the Data Protection Authority's decision), the categories of personal data (point 1.a. of the Data Protection Authority's decision), and the "creditworthiness data" (point 1.b. of the Data Protection Authority's decision). The appeal should therefore be upheld on these points.

5 The Administrative Court justified the admissibility of the appeal on the grounds of the lack of supreme court case law on Article 15 (1) (h) GDPR, in particular on the legal question of what meaningful information about the logic involved in automated decision-making must be made available to the data subject by the controller pursuant to Article 15 (1) (h) GDPR.

6 This ordinary appeal is directed against this finding. In its response to the appeal, the co-participant requested that the appeal be dismissed, or alternatively, dismissed, with reimbursement of expenses. The respondent authority also requested that the appeal be dismissed with reimbursement of expenses in its response to the appeal.

7 By order of 7 April 2022, Ro 2020/04/0010-9, the Higher Administrative Court stayed the present appeal proceedings pending a preliminary ruling by the Court of Justice of the European Union (CJEU) on the request of the Vienna Administrative Court of 11 February 2022, VWG-101/042/791/2020-44 (Case C-203/22, Dun & Bradstreet Austria), and the request of the Wiesbaden Administrative Court of 1 October 2021, 6 K 788/20.W1 (Case C-634-21, SCHUFA Holding (Scoring)), because the answers to the questions referred are also relevant for the consideration of the present appeal.

8 By judgment of 7 December 2023, Case C-634-21, SCHUFA Holding [Scoring], the ECJ ruled on the request for a preliminary ruling from the Wiesbaden Administrative Court, and by judgment of 27 February 2025, Case C-203/22, Dun & Bradstreet Austria, on the request for a preliminary ruling from the Vienna Administrative Court.

The Higher Administrative Court considered:

Admissibility

9 Contrary to the arguments of the co-parties in their response to the appeal, the party appealing the appeal sufficiently clearly asserts that the violation of the right to non-determination, that the co-parties' right to information has been violated, is a valid point of appeal (see, for example, VwGH 19 April 2024, Ro 2023/04/0047, marginal no. 7, with further references, on the determination of the subject matter of the proceedings before the Administrative Court by designating the points of appeal in an appeal).

10 The appeal is admissible on the fundamental legal issue presented by the Administrative Court, to which the party appealing the appeal refers in its submissions on the grounds of appeal, contrary to the arguments of the co-parties in their response to the appeal; however, it is not justified.

Legal Situation

11       Since the right to information is not a one-off event that, in this case, cannot be considered completed before the GDPR enters into force, the GDPR and the Data Protection Act (DSG) in the versions applicable at the time of the Administrative Court's decision are to be used as the relevant legal situation (see VwGH 6 March 2024, Ro 2021/04/0037, paras. 18 et seq., with further references).

12 The relevant recitals and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR), OJ L 119, 4 May 2016, p. 1, read as follows:

"(4) The processing of personal data should serve humanity. The right to the protection of personal data is not an absolute right; it must be considered in the light of its societal function and balanced against other fundamental rights, while respecting the principle of proportionality. This Regulation respects all fundamental rights and respects all the freedoms and principles recognized by the [Charter of Fundamental Rights of the European Union (hereinafter: the Charter)] and enshrined in the European Treaties, in particular respect for private and family life, of home and communication, protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and a fair trial, and cultural, religious and linguistic diversity.

...

(11) Effective Union-wide protection of personal data requires strengthening and precisely defining the rights of data subjects and tightening the obligations on those who process and decide on personal data, as well as equal powers in the Member States to monitor and ensure compliance with the rules on the protection of personal data and equal sanctions in the event of breaches. ...

(58) The principle of transparency requires that information intended for the public or the data subject be precise, easily accessible and comprehensible, using clear and plain language and, where appropriate, visual elements. ...

...

(63) A data subject should have a right of access to the personal data concerning him or her that have been collected and be able to exercise this right easily and at reasonable intervals in order to object to the processing. to be aware of and to be able to verify their legality. ... This right should not adversely affect the rights and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software. However, this must not result in the data subject being denied any information. ...

...

(71) The data subject should have the right not to be subjected to a decision, which may include a measure, evaluating personal aspects concerning him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as the automatic rejection of an online credit application or online recruitment process without any human intervention. Such processing includes profiling, which consists in any form of automated processing of personal data evaluating personal aspects relating to a natural person, in particular to analyze or predict aspects concerning his or her performance at work, economic situation, health, personal preferences or interests, reliability or behavior, location or movements, where such processing produces legal effects concerning the data subject. individual or similarly significantly affects him or her. ... In any event, such processing should be accompanied by appropriate safeguards, including the provision of specific information to the data subject and the right to obtain direct human intervention, to express his or her point of view, to obtain an explanation of the decision taken following an assessment, and to contest that decision.

...

Article 4

Definitions

For the purposes of this Regulation, the following definitions shall apply:

...

4. ‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

...

Article 12

Transparent information, communication and modalities for exercising the data subject’s rights

1. The controller shall take appropriate measures to provide the data subject with all information referred to in Articles 13 and 14 and all communications referred to in Articles 15 to 22 and Article 34 relating to the processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular as regards information specifically addressed to children. ...

...

Article 13

Information obligation when collecting personal data from the data subject

...

(2) In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following further information at the time of collecting those data, which is necessary to ensure fair and transparent processing:

...

f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

...

Article 14

Information obligation where the personal data were not collected from the data subject

...

(2) In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information, which is necessary to ensure fair and transparent processing for the data subject:

...

g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

...

Article 15

Right of access of the data subject

(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed; If this is the case, they have the right to access those personal data and to the following information:

...

h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

...

(3) The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject indicates otherwise.

(4) The right to receive a copy pursuant to paragraph 1b shall not adversely affect the rights and freedoms of others.

...

Article 22

Automated individual decision-making, including profiling

(1) The data subject shall have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

(2) Paragraph 1 shall not apply if the decision

a) is necessary for entering into, or the performance of, a contract between the data subject and the controller;

b) is authorized by Union or Member State law to which the controller is subject, and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

c) is based on the data subject's explicit consent.

(3) In the cases referred to in points (a) and (c) of paragraph 2, the controller shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

(4) Decisions pursuant to paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless points (a) or (g) of Article 9(2) apply and suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject have been taken.

13 The relevant recitals and provisions of Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and confidential business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1) read as follows:

‘(35) ... Directive 95/46/EC of the European Parliament and of the Council (1) applies to the processing of personal data carried out within the framework of this Directive under the supervision of the competent authorities of the Member States, and in particular of the independent public bodies designated by them. Therefore, this Directive should ensure the rights and obligations laid down in Directive 95/46/EC, in particular the data subject’s right of access to his or her personal data being processed, as well as to rectification, erasure or blocking of incomplete or inaccurate data, and, where appropriate, the obligation to process sensitive data in accordance with Article 8(5) of Directive 95/46/EC.

(1) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

...

Article 2

Definitions

For the purposes of this Directive, the following definitions shall apply:

1. ‘Trade secret’ means information which satisfies all of the following criteria:

(a) it is secret in the sense that it cannot be disclosed, either in its entirety or the precise arrangement and composition of its components is generally known or readily accessible to persons in circles who habitually deal with this type of information;

b) it has commercial value because it is secret;

c) it is subject to appropriate confidentiality measures, appropriate to the circumstances, by the person who has lawful control of the information;

...

Article 9

Maintaining the confidentiality of trade secrets in the course of legal proceedings

1. Member States shall ensure that the parties, their legal or other representatives, court officials, witnesses, experts and any other persons involved in legal proceedings concerning the unlawful acquisition, use or disclosure of a trade secret, or who have access to documents forming part of such legal proceedings, are not authorised to use or disclose a trade secret or an alleged trade secret which has been classified as confidential by the competent courts following a duly substantiated request from an interested party; and of which they have become aware as a result of participating in the proceedings or having access to the documents. Member States may also empower the competent courts to take such measures of their own motion.

The obligation referred to in the first subparagraph shall continue to apply even after the conclusion of the legal proceedings. However, the obligation shall cease if one of the following situations occurs:

a) a final decision establishes that the alleged trade secret does not meet the criteria referred to in Article 2(1); or

b) over time, the information in question becomes generally known or readily accessible to persons in the circles that normally deal with that type of information.

2. Member States shall further ensure that, upon a duly substantiated request from a party, the competent courts may take specific measures necessary to protect the confidentiality of a trade secret or an alleged trade secret used or referred to in the course of legal proceedings relating to the unlawful acquisition, use or disclosure of a trade secret. Member States may also empower the competent courts to take such measures of their own motion.

The measures referred to in the first subparagraph shall at least provide for the possibility of:

a) restricting access, in whole or in part, to documents submitted by the parties or third parties containing business secrets or alleged business secrets to a limited number of persons;

b) restricting access to hearings at which business secrets or alleged business secrets may be disclosed, and to the corresponding recording or transcript of those hearings, to a limited number of persons;

c) providing persons who are not part of the limited number of persons referred to in points (a) and (b) with a non-confidential version of a judicial decision in which the passages containing business secrets have been deleted or redacted.

The number of persons referred to in points (a) and (b) of the second subparagraph shall not be greater than necessary to safeguard the right of the parties to the proceedings to an effective remedy and to a fair trial and shall include at least one natural person from each party and their respective lawyers or other representatives of those parties to the proceedings.

(3) When deciding on the measures referred to in paragraph 2 and assessing their proportionality, the competent courts shall take into account the need to safeguard the right to an effective remedy and to a fair trial, the legitimate interests of the parties and, where appropriate, of any third parties, and the potential harm that the granting or refusal of those measures may cause to one of the parties and, where appropriate, to any third party.

(4) Any processing of personal data pursuant to paragraphs 1, 2, or 3 shall be carried out in accordance with Directive 95/46/EC.

14 Section 4 (6) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended by Federal Law Gazette I No. 14/2019, reads:

"Scope of application and implementing provisions

Section 4. ... Paragraph 4, ...

(6) The data subject's right to information pursuant to Article 15 GDPR shall, without prejudice to other statutory restrictions, generally not exist vis-à-vis a controller if providing this information would jeopardize a business or trade secret of the controller or a third party." (6) The data subject's right to information pursuant to Article 15 GDPR shall, without prejudice to other statutory restrictions, generally not exist vis-à-vis a controller if providing this information would jeopardize a business or trade secret of the controller or a third party."

Right to information pursuant to Art. 15 (1) (h) GDPR

15 Pursuant to Art. 15 (1) (h) GDPR, the data subject has the right to information about the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR, and, in this case, the right to meaningful information about the logic involved, as well as the scope and intended effects of such processing for them. The right to information about the logic involved, which is to be assessed here, presupposes the existence of an "automated decision in the individual case" within the meaning of Art. 22 (1) GDPR.

16 According to the case law of the ECJ (ECJ December 7, 2023, C-634/21, SCHUFA Holding [Scoring], para. 73), an "automated individual decision" within the meaning of Article 22(1) GDPR exists if a credit agency automatically creates a probability value based on personal data relating to a person regarding that person's ability to meet future payment obligations, provided that this probability value is crucial for determining whether a third party to whom this probability value is transmitted establishes, implements, or terminates a contractual relationship with that person.

17 The existence of the factual basis for the existence of automated decision-making pursuant to Article 22(1) GDPR is undisputed.

18 Rather, regarding the scope of the co-participants' right to information about the logic involved under Article 15(1)(h) GDPR, the party appealing for an appeal argues that it has satisfied the co-participants' request for information by disclosing the stored data and providing a rough outline of the logic. A general description of how the scores are calculated is sufficient to explain to the co-participant the actual facts that influenced the assessment and, if necessary, to respond to errors.

19 The co-participant, in contrast, argues that the abstract explanations of the party appealing for an appeal regarding the procedure for calculating the scores are neither concrete nor sufficiently transparent, nor do they enable the comprehensibility of the specific "score value" calculated for the co-participant. Based on the information provided so far, the co-participant could not assert its rights as a data subject because it was in no way comprehensible to it which parameters, and to what extent, had been used by the party appealing the appeal to calculate the "score value."

20 In summary, the Administrative Court found that the co-participants' right to information pursuant to Article 15 (1) (h) GDPR had been violated because the party appealing the appeal had not provided any meaningful information about how the "score" of 2.6 assigned to the co-participant was determined (regarding the logic involved). However, the Administrative Court considered the information provided by the party appealing the appeal to be sufficient regarding the scope and intended effects of the automated decision-making process.

21 In its judgment of 27 February 2025, C-203/22, Dun & Bradstreet Austria, the ECJ stated the following regarding the interpretation of Article 15(1)(h) GDPR with regard to the concept of "meaningful information about the logic involved" of automated decision-making (including profiling) within the meaning of Article 22(1) GDPR, namely the automated processing of personal data of data subjects to obtain a specific result - such as, in this case, a credit profile:

"39 According to the Court's settled case-law, in interpreting a provision of EU law, it is necessary to consider not only its wording but also its context and the objectives pursued by the rules of which it is part (judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 19 and the case-law cited therein).

40 As regards, first, the wording of Article 15(1)(h) GDPR, it should be noted that, first, the meanings of the expression ‘meaningful information’ within the meaning of that provision differ in its various language versions – some versions, such as the French version, focus on the functionality (‘nuttige’ in the Dutch version, ‘úteis’ in the Portuguese version) or the relevance (‘pertinente’ in the Romanian version) of the information to be transmitted, while others focus more on the meaning of that information (‘significativa’ in the Spanish version and ‘istotne’ in the Polish version). Finally, the terms used in the German and English versions of that provision (‘aussagekräftig’ and ‘meaningful’, respectively) can be interpreted differently. can be understood both as meaning that the information is easy to understand and as meaning that it is about a certain quality of the information.40 As regards, first, the wording of Article 15, paragraph 1, letter h, GDPR, it should be noted that, on the one hand, the meanings of the expression ‘meaningful information’ within the meaning of this provision differ in its various language versions – in some versions, such as the French version, the focus is on the functionality (‘nuttige’ in the Dutch version, ‘úteis’ in the Portuguese version) or the relevance (‘pertinente’ in the Romanian version) of the information to be transmitted, while in other versions the focus is more on the meaning of this information (‘significativa’ in the Spanish version and ‘istotne’ in the Polish version). Finally, the terms used in the German and English versions of this provision (‘aussagekräftig’ or ‘meaningful’) can be understood both as referring to the clear comprehensibility of the information and as referring to a certain quality of the information.

41 The diversity of meanings in the various language versions must be understood in the sense of complementarity between the meanings set out in the preceding paragraph, which must be taken into account when interpreting the expression ‘meaningful information about the logic involved’ within the meaning of Article 15(1)(h) GDPR, as essentially stated by the Advocate General in point 65 of his Opinion.41 The diversity of meanings in the various language versions must be understood in the sense of complementarity between the meanings set out in the preceding paragraph, which must be taken into account when interpreting the expression ‘meaningful information about the logic involved’ within the meaning of Article 15(1)(h) GDPR, as essentially stated by the Advocate General in Point 65 of the Opinion.

42 Secondly, given the general wording, the reference to this provision, or rather to the 'logic involved' in automated decision-making, which is the subject of 'meaningful information', may encompass a broad spectrum of 'logics' applied when personal data or other data are processed to achieve a particular result with the aid of automated means. This interpretation is supported by certain language versions of the provision, which use terms that combine various aspects of the ordinary meaning of the term 'logic'. This applies, for example, to the Czech and Polish language versions, which use the terms 'postupu' and 'zasady', respectively, which can be translated as 'procedures' and 'principles'.

43 Therefore, the wording of Article 15(1)(h) GDPR encompasses all information relevant to the procedure and principles of automated processing of personal data to achieve a specific result on the basis of those data.43 Therefore, the wording of Article 15(1)(h) GDPR encompasses all information relevant to the procedure and principles of automated processing of personal data to achieve a specific result on the basis of those data.

44 As regards the context in which the expression ‘meaningful information about the logic involved’, contained in Article 15(1)(h) of the GDPR, fits, it should be noted, first, that this information constitutes only part of the information covered by the right of access provided for in that provision, since that right also includes information on the scope and envisaged effects of the processing in question for the data subject.44 As regards the context in which the expression ‘meaningful information about the logic involved’, contained in Article 15(1)(h) of the GDPR fits, it should be noted, first, that this information constitutes only part of the information covered by the right of access provided for in that provision, since that right also includes information on the scope and envisaged effects of the processing in question for the data subject.

45 Although that information, for which, in accordance with the Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, adopted on 3 October 2017 by the Working Party on Data Protection established by Article 29 of Directive 95/46, as revised and adopted on 6 February 2018, ‘real, tangible examples’ must be provided in order to make it meaningful and understandable, is not the subject of the referring court’s questions, it must nevertheless be taken into account as part of the context to which the expression ‘meaningful information about the logic involved’ belongs.45 Although that information, for which, in accordance with the Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, adopted on 3 October 2017 by the Working Party on Data Protection established by Article 29 of Directive 95/46, as revised and adopted on 6 February 2018, that 'real, tangible examples' must be provided to make them meaningful and understandable are not the subject of the referring court's questions, but they must be taken into account as part of the context to which the expression 'meaningful information about the logic involved' belongs.

46 Second, as regards the fact that the expression ‘meaningful information about the logic involved’ also appears in Article 13(2)(f) and Article 14(2)(g) of the GDPR, the Court has already held that, in the case of automated decision-making within the meaning of Article 22(1) GDPR, the right of access to that information, enshrined in Article 15(1)(h) of the GDPR, and the additional information obligations of the controller under Article 13(2)(f) and Article 14(2)(g) of the GDPR form a single entity (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C-634/21, EU:C:2023:957, paragraph 56).46 Second, as regards the fact that the expression 'meaningful information about the logic involved' also appears in Article 13(2)(f) and Article 14(2)(g) GDPR, it has already been established that, in the case of automated decision-making within the meaning of Article 22(1) GDPR, the right to information concerning this information enshrined in Article 15(1)(h) GDPR and the additional information obligations of the controller pursuant to Article 13(2)(f) and Article 14(2)(g) GDPR form a single entity (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others [Scoring], C-634/21, EU:C:2023:957, paragraph 56).

47 Third, as essentially stated by the Advocate General in points 58 to 60 of his Opinion, the contextual interpretation of the rights of access provided for in the event of automated decision-making must take into account the case-law of the Court of Justice on the requirements that the controller must meet under Article 15(3) of the GDPR.47 Third, as essentially stated by the Advocate General in points 58 to 60 of his Opinion, the contextual interpretation of the rights of access provided for in the event of automated decision-making must take into account the case-law of the Court of Justice on the requirements that the controller must meet under Article 15(3) of the GDPR.

48 In particular, account must be taken of the fact that the requirement of transparency of the information provided, provided for in Article 12(1) GDPR, applies to all data and information pursuant to Article 15, including that relating to automated decision-making.48 In particular, account must be taken of the fact that the requirement of transparency of the information provided, provided for in Article 12(1) GDPR, applies to all data and information pursuant to Article 15, including that relating to automated decision-making.

49 In order to ensure that the data subject is able to fully understand the information communicated to him or her by the controller, Article 12(1) GDPR requires the controller to take appropriate measures to ensure that the data and information are provided, in particular, to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 38).49 In order to ensure that the data subject is able to fully understand the information communicated to him or her by the controller, Article 12(1) GDPR requires the controller to take appropriate measures to ensure that the data and information is provided, in particular, to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, para. 38).

50 An examination of the context of Article 15(1)(h) of the GDPR thus confirms the interpretation resulting from the analysis of the terms used in that provision, according to which ‘meaningful information about the logic involved’ in an automated decision-making process, within the meaning of that provision, includes all relevant information on the process and principles of automated processing of personal data to achieve a specific result and, in view of the requirement of transparency, that information must also be provided in a precise, transparent, intelligible and easily accessible form.50 An examination of the context of Article 15(1)(h) of the GDPR thus confirms the interpretation resulting from the analysis of the terms used in that provision, according to which ‘meaningful information about the logic involved’ in an automated decision-making process, within the meaning of that provision, includes all relevant information on the process and principles of automated processing of personal data to achieve a specific result and, in view of the requirement of transparency, that information must also be provided in a precise, must be provided in a transparent, understandable, and easily accessible form.

51 Finally, as regards the purpose of the GDPR, it should be recalled that its objective is, in particular, to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data, guaranteed by Article 16 TFEU, enshrined as a fundamental right in Article 8 of the Charter and complementing the right to private life, enshrined in Article 7 of the Charter (see, to that effect, judgment of 4 October 2024, Schrems (Communication of data to the general public), C-446/21, EU:C:2024:834, paragraph 45 and the case-law cited).51 Finally, as regards the purpose of the GDPR, it should be recalled that its objective is, in particular, to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data, guaranteed by Article 16 TFEU, enshrined as a fundamental right in Article 8 of the Charter fundamental right and complements the right to private life enshrined in Article 7 of the Charter (see, to that effect, judgment of 4 October 2024, Schrems (Communication of data to the general public), C-446/21, EU:C:2024:834, paragraph 45 and the case-law cited).

52 The GDPR therefore aims, as is clear from its eleventh recital, to strengthen and precisely define the rights of data subjects (judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 33 and the case-law cited).

53 As regards, specifically, the right of access provided for in Article 15 of the GDPR, according to the case-law of the Court of Justice, it must enable the data subject to verify whether the data concerning him or her are accurate and whether they are being processed lawfully (judgments of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 34, and of 26 October 2023, FT (Copies of the patient file), C-307/22, EU:C:2023:811, paragraph 73). 53 As regards, specifically, the right of access provided for in Article 15 of the GDPR, according to the case-law of the Court of Justice, it must enable the data subject to verify whether the data concerning him or her are accurate and whether they are being processed lawfully (judgments of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 34, and of 26 October 2023, FT (Copies of the patient file), C-307/22, EU:C:2023:811, paragraph 73).

54 This right of access is necessary to enable the data subject to exercise, where appropriate, his or her right to rectification, his or her right to erasure (‘right to be forgotten’) and his or her right to restriction of processing, which he or she enjoys under Articles 16, 17 and 18 of the GDPR, as well as his or her right to object to the processing of his or her personal data provided for in Article 21 of the GDPR, or his or her right to a judicial remedy or to compensation for damages provided for in Articles 79 and 82 of the GDPR (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 35).54 This right of access is necessary to enable the data subject to exercise, where appropriate, his or her right to rectification, his or her right to erasure (‘right to be forgotten’) and his or her right to restriction of processing, which to exercise their rights under Articles 16, 17 and 18 of the GDPR, as well as their right to object to the processing of their personal data provided for in Article 21 of the GDPR or their rights to a judicial remedy or to compensation for damages provided for in Articles 79 and 82 of the GDPR (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 35).

55 In particular, in the specific context of the adoption of a decision based solely on automated processing, the data subject’s right to receive the information referred to in Article 15(1)(h) of the GDPR is primarily intended to enable him or her to effectively exercise the rights conferred on him or her by Article 22(3) of the GDPR, namely the right to express his or her point of view and the right to contest the decision.55 In particular, in the specific context of the adoption of a decision based solely on automated processing, the data subject’s right to receive the information referred to in Article 15(1)(h) of the GDPR is primarily intended to enable him or her to effectively exercise the rights conferred on him or her by Article 22(3) of the GDPR, namely the right to express his or her point of view and the right to contest the decision.

56 If data subjects subject to an automated decision, including profiling, were not able to understand the reasons for that decision before expressing their point of view or contesting that decision, those rights would not fully achieve their purpose of protecting those data subjects against the specific risks to their rights and freedoms that are posed by the automated processing of personal data (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C-634/21, EU:C:2023:957, paragraph 57). 56 If data subjects subject to an automated decision, including profiling, were not able to understand the reasons for that decision before expressing their point of view or contesting that decision, those rights would not fully achieve their purpose of protecting those data subjects against the specific risks to their rights and freedoms that are posed by the automated processing of personal data. see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C-634/21, EU:C:2023:957, paragraph 57).

57 According to recital 71 of the GDPR, where the data subject is subject to a decision based solely on automated processing which significantly affects him or her, the data subject must have the right to an explanation of that decision. As stated by the Advocate General in point 67 of his Opinion, Article 15(1)(h) GDPR therefore provides the data subject with a genuine right to an explanation of the functioning of the automated decision-making mechanism to which that data subject has been subjected and of the result of that decision.57 According to recital 71 of the GDPR, where the data subject is subject to a decision based solely on automated processing which significantly affects him or her, the data subject must have the right to an explanation of that decision. As the Advocate General stated in point 67 of his Opinion, Article 15(1)(h) GDPR therefore provides the data subject with a genuine right to an explanation of the functioning of the automated decision-making mechanism to which that person has been subjected and of the result of that decision.

58 It follows from an examination of the objectives of the GDPR, and in particular of Article 15(1)(h) GDPR, that the right to ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of that provision, must be understood as a right to an explanation of the procedure and principles applied in the automated processing of the data subject’s personal data in order to arrive at a particular result – such as a credit profile – on the basis of those data. In order for the data subject to effectively exercise the rights granted to him or her by the GDPR, and in particular Article 22(3) thereof, the relevant information must be provided in a concise, transparent, intelligible, and easily accessible form within the framework of this explanation.58 From an examination of the objectives of the GDPR, and in particular Article 15(1)(h) GDPR, it follows that the right to 'meaningful information about the logic involved' in automated decision-making within the meaning of this provision is to be understood as a right to an explanation of the procedure and principles used in the automated processing of the data subject's personal data to arrive at a specific result – such as a credit profile – on the basis of those data. In order for the data subject to effectively exercise the rights granted to him or her by the GDPR, and in particular Article 22(3) thereof, the relevant information must be provided in a concise, transparent, intelligible, and easily accessible form within the framework of this explanation.

59 Neither the mere transmission of a complex mathematical formula (such as an algorithm) nor the detailed description of each step of an automated decision-making process meets these requirements, as neither constitutes a sufficiently precise and comprehensible explanation.

60 As is clear from page 28 of the Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, referred to in paragraph 45 of the present judgment, the controller should, first, find simple ways to inform the data subject of the considerations or criteria underlying the decision-making process. Second, the GDPR obliges the controller to provide meaningful information about the logic involved, 'not necessarily a detailed explanation of the algorithms used or the disclosure of the entire algorithm'.60 As is clear from Session 28 of the Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, referred to in paragraph 45 of the present judgment, first, the controller should find simple ways to inform the data subject about the considerations or criteria underlying the decision-making process. Second, the GDPR obliges the controller to provide meaningful information about the logic involved, 'not necessarily a detailed explanation of the algorithms used or the disclosure of the entire algorithm'.

61 The ‘meaningful information about the logic involved’ of an automated decision-making process within the meaning of Article 15(1)(h) GDPR must therefore describe the procedure and the principles that are specifically applied in such a way that the data subject can understand which of his or her personal data were used in what way within the framework of the automated decision-making process in question, without the complexity of the steps to be carried out within the framework of an automated decision-making process being able to release the controller from its obligation to provide explanations.61 The ‘meaningful information about the logic involved’ of an automated decision-making process within the meaning of Article 15(1)(h) GDPR must therefore describe the procedure and the principles that are specifically applied in such a way that the data subject can understand which of his or her personal data were used in what way within the framework of the automated decision-making process in question, without the complexity of the steps to be carried out within the framework of an automated decision-making process being able to release the controller from its obligation to provide explanations. could be released from its obligation to provide explanations.

62 As regards, specifically, profiling such as that at issue in the main proceedings, the referring court might, in particular, consider it sufficiently transparent and comprehensible to inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result.

63 Furthermore, as regards the question whether the information communicated must enable the data subject to verify the accuracy of the personal data concerning him or her that form the basis of the automated decision-making process, it should be noted that the right to access those data is not based on Article 15(1)(h) of the GDPR, but on the introductory sentence of Article 15(1) of the GDPR, which guarantees the data subject the right to verify the accuracy of those data; This is clear from the case-law cited in paragraph 53 of the present judgment.63 Furthermore, as regards the question whether the information communicated must enable the data subject to verify the accuracy of the personal data concerning him or her which form the basis for the automated decision-making, it should be noted that the right of access to those data is not based on Article 15(1)(h) of the GDPR, but on the introductory sentence of Article 15(1) of the GDPR, which guarantees the data subject the right to verify the accuracy of those data; this is clear from the case-law cited in paragraph 53 of the present judgment.

64 Finally, as regards the referring court's finding that the information provided to CK by D & B pursuant to Article 15(1)(h) of the GDPR is inaccurate, since CK should be considered to have no financial standing on the basis of the 'actual' profiling, even though that information suggests the opposite, it should be noted that, although, according to the referring court, the non-compliance thus established is due to D & B's failure to inform CK of the profiling concerning her that had been carried out for the mobile operator and on the basis of which CK was refused the conclusion or renewal of a contract, that fact could be remedied by means of the right to access the credit profile thus drawn up. In this regard, it is clear from the case-law of the Court that personal data generated by the controller itself fall within the scope of Article 14 of the GDPR (see, to that effect, judgment of 28 November 2024, Másdi, C-169/23, EU:C:2024:988, paragraph 48).64 Finally, as regards the referring court’s finding that the information communicated to CK by D&B pursuant to Article 15(1)(h) of the GDPR is inaccurate, since CK must be considered to have no financial means on the basis of the ‘actual’ profiling, even though that information suggests the opposite, it should be noted that, although, according to the referring court, the non-compliance thus established is due to the fact that D&B did not inform CK of the profiling concerning her that had been carried out for the mobile operator and on the basis of which CK was refused the conclusion or renewal of a contract, that fact was not disclosed by the right to information on the credit profile thus created. In this regard, it follows from the case law of the Court of Justice that personal data generated by the controller itself fall within Article 14 of the GDPR (see, to that effect, judgment of 28 November 2024, Másdi, C-169/23, EU:C:2024:988, paragraph 48).

65 However, an explanation of the differences between the result of such 'actual' profiling - assuming it was carried out - and the result communicated to CK by D&B, which, according to D&B, was arrived at by giving the data concerning CK an 'equivalent weight', does indeed fall within the scope of 'meaningful information on the logic involved' in the profiling thus created. In accordance with paragraph 58 of this judgment, D&B would therefore have to explain, in a precise, transparent, understandable and easily accessible manner, the procedure and principles on the basis of which the 'actual' profiling was carried out.

66 In accordance with the above, the answer to the first and second questions referred, as well as question 3.a), must be that Article 15(1)(h) GDPR is to be interpreted as meaning that, in the case of automated decision-making (including profiling) within the meaning of Article 22(1) GDPR, the data subject may, in the context of the right to be provided with ‘meaningful information about the logic involved’, require the controller to explain to him or her, on the basis of the relevant information, in a precise, transparent, intelligible and easily accessible form, the procedure and principles specifically applied in the automated processing of his or her personal data to obtain a specific result – for example, a credit profile.’66 In accordance with the above, the answer to the first and second questions referred, as well as question 3.a), must be that Article 15(1)(h) GDPR is to be interpreted as meaning that, in the case of automated decision-making (including Profiling) within the meaning of Article 22, paragraph 1, GDPR, the data subject may, as part of the right to be provided with 'meaningful information about the logic involved', require the controller to explain to him or her, on the basis of the relevant information, in a precise, transparent, intelligible and easily accessible form, the procedure and principles specifically applied in the automated processing of his or her personal data to obtain a specific result - for example, a credit profile.

22       Proceeding from this, the "meaningful information on the logic involved" in determining the score, which the party requesting the appeal must provide to the co-participant pursuant to Art. 15 (1) (h) GDPR, must describe the procedure and principles specifically applied, and the procedure and principles must be explained by the party requesting the appeal to the co-participant in such a way that the co-participant can understand the functioning of the automated decision-making mechanism and the result to which the decision led. Accordingly, the co-participant must be informed of which of their personal data were used and how in determining the score, in order to enable them to exercise their rights, in particular the right to express their own point of view and the right to contest the decision based on an automated decision pursuant to Art. 22 (3) GDPR.

23       The party seeking the appeal did indeed inform the co-participant of the individual personal data taken into account in calculating the "score" disclosed to it. Furthermore, it pointed out that, due to the lack of known "environmental and creditworthiness data," only these personal ("sociodemographic") data were taken into account and weighted "equally" among each other. However, the party seeking the appeal did not sufficiently explain to the co-participant how the co-participant's personal data were used in calculating its "score" to enable the co-participant to exercise its rights, in particular those under Article 22 (3) GDPR.

24 For example, the blanket reference to an "equal" weighting of the aforementioned personal "sociodemographic" data does not explain the significance, at least in principle, of the individual processed personal data of the co-participants, such as age, residential address, living conditions, and the absence of payment history data, for the calculation of the co-participants' "score value" of "2.6" determined by the party seeking the appeal. It remains unclear how a higher or lower age, a different residential address, or a different living situation affects the calculation of the "score."

25 Equally incomprehensible is the consideration of the information in the letter of the party appealing the appeal dated January 20, 2017, that the co-participant had fulfilled its payment obligations to date in accordance with the agreement and that no current lawsuits or disputes were known, as this information was paraphrased as "no known negative characteristics" within the framework of the automated calculation method of the "score." Thus, when assessing a person's creditworthiness, there is a significant difference depending on whether that person has fulfilled their payment obligations to date in accordance with the agreement and no other lawsuits or disputes are known, or whether neither positive nor negative payment history data, or merely no negative payment history data, is known.

26       The party seeking the appeal has therefore not adequately explained to the co-participant the procedure and principles applied in the automated processing of the co-participant's personal data to collect their scores, in accordance with Article 15(1)(h) GDPR, using the relevant information in a precise, transparent, understandable, and easily accessible form.

Trade secret within the meaning of Article 2(1) of Directive 2016/943, which conflicts with the right to information pursuant to Article 15(1)(h) GDPR. Trade secret within the meaning of Article 2(1) of Directive 2016/943, which conflicts with the right to information pursuant to Article 15(1)(h) GDPR.

27 Finally, the party appealing the appeal argues that the disclosure of further information to the co-participant is precluded by the trade secret it enjoys as a credit agency regarding its calculation method for generating the scores. The creation of the calculation formula is based, in particular, on the analysis of data sets by determining general correlations and significances. "The algorithms used to generate these scores" contain the "relevant and significant characteristics from the analysis, as well as their weighting and relationship to one another." Only in a subsequent step is a personal value calculated from this calculation formula with a number of variables by inserting the data subject's personal data into the variables. Thus, the contents of the "score formula" (calculation method), which are protected as trade secrets, include the general calculation parameters incorporated into the "score formula" in the first step, such as the statistical values used, the weighting of individual calculation elements in determining the probability value, and the formation of any comparison groups as the basis for the "score." The development of the "score" is therefore complex and requires specific expertise. Furthermore, the validity of the forecast and thus the competitiveness as well as "the market value of the product and the credit agency itself" depend on the respective method.

28       In contrast, the co-participant argues that the respondent authority and the Administrative Court should be followed in their view that a general reference to a trade secret – as in the present case – does not constitute sufficient grounds for refusing to provide information. The co-participant never requested "recalculability or mathematical explanations." The information not yet provided by the party appealing the appeal, namely "which parameters and to what extent the appellant used to calculate the scoring value," can be provided without violating business or trade secrets.

29       The respondent authority also argues in its response to the appeal that information cannot be refused with a blanket reference to business and trade secrets. Furthermore, it does not require extensive mathematical explanations or detailed descriptions of the functioning of algorithms, but rather information about the logic involved. Ultimately, this information must be sufficiently informative to allow for the correction of a certain parameter relevant to the decision-making process or to initiate a review of the legality of a weighting.

30 In its judgment of February 27, 2025, C-203/22, Dun & Bradstreet Austria, the ECJ, interpreting Article 15(1)(h) GDPR, also addressed the relationship between the data subject's right of access provided for in that provision and the trade secrets that conflict with that right within the meaning of Article 2(1) of Directive 2016/943, and stated the following:

"68 According to recital 4 of the GDPR, the right to the protection of personal data is not an absolute right and must be balanced against other fundamental rights, while respecting the principle of proportionality. Thus, the GDPR is consistent with all fundamental rights and respects all the freedoms and principles recognized by the Charter and enshrined in the Treaties (judgment of October 26, 2023, FT [Copies of patient records], C-307/22, EU:C:2023:811, paragraph 59 and the case-law cited therein).

69 Furthermore, according to recital 63 of this Regulation, the data subject's right of access to personal data concerning him or her that have been collected should not adversely affect the rights and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software.

70 However, this must not lead to the data subject being denied any information. Article 23(1)(i) GDPR essentially provides that a limitation of the scope of the obligations and rights provided for, inter alia, in Article 15 GDPR is only possible if such a limitation respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society to ensure the protection of the rights and freedoms of others. 70 However, this must not lead to the data subject being denied any information. Article 23(1)(i) i GDPR essentially provides that a limitation of the scope of the obligations and rights provided for, inter alia, in Article 15 GDPR is only possible if such a limitation respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society to ensure the protection of the rights and freedoms of others.

71 With regard to the related right to receive a copy, enshrined in Article 15(4) GDPR, the Court has already held that its exercise should not adversely affect the rights and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 43). 71 With regard to the related right to receive a copy, enshrined in Article 15(4) GDPR, the Court has already held that its exercise and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 43).

72 In this context, the Court has held that, in the event of a conflict between the exercise of the right to full and comprehensive access to personal data, on the one hand, and the rights or freedoms of other persons, on the other, the rights in question must be balanced. Where possible, the methods of transmitting personal data must be chosen which do not infringe the rights or freedoms of others, provided that these considerations ‘must not lead to a refusal to provide the data subject with any information’, as follows from recital 63 of the GDPR (judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 44).

73 As regards the question of how the right of access under Article 15(1)(h) GDPR can be implemented in a way that safeguards the rights and freedoms of other persons, it should be noted that, according to case-law, a national court may consider that personal data of parties or third parties must be communicated to it in order to enable it, in full knowledge of the facts and in compliance with the principle of proportionality, to weigh the interests at stake. That assessment may, where appropriate, lead it to authorize the full or partial disclosure to the other party of the personal data thus communicated if it considers that such disclosure does not go beyond what is necessary to ensure the effective exercise of the rights conferred on individuals by Article 47 of the Charter (judgment of 2 March 2023, Norra Stockholm Bygg, C-268/21, EU:C:2023:145, Paragraph 58).73 As regards the question of how the right of access under Article 15(1)(h) GDPR can be implemented in a way that safeguards the rights and freedoms of other persons, it should be noted that, according to case-law, a national court may consider that personal data of parties or third parties must be communicated to it in order to enable it, in full knowledge of the facts and in compliance with the principle of proportionality, to weigh up the interests involved. This assessment may, where appropriate, lead it to authorise the full or partial disclosure to the other party of the personal data thus communicated if it considers that such disclosure does not go beyond what is necessary to ensure the effective exercise of the rights conferred on individuals by Article 47 of the Charter (judgment of 2 March 2023, Norra Stockholm Bygg, C-268/21, EU:C:2023:145, paragraph 58).

74 As stated by the Advocate General in As stated in point 94 of his Opinion, this case law can be applied without restriction to the case where the information that must be made available to the data subject in the context of the right of access guaranteed by Article 15(1)(h) of the GDPR is likely to adversely affect the rights and freedoms of other persons, in particular because it contains personal data of third parties protected by the GDPR or a trade secret within the meaning of Article 2(1) of Directive 2016/943. In this case too, this information must be transmitted to the competent supervisory authority or court, which must weigh the conflicting rights and interests in order to determine the scope of the data subject’s right of access to the personal data concerning him or her.74 As stated by the Advocate General in point 94 of his Opinion, this case law can be applied without restriction to the case where the information that must be made available to the data subject in the context of the right of access guaranteed by Article 15(1)(h) of the GDPR are likely to adversely affect the rights and freedoms of other persons, in particular because they contain personal data of third parties protected by the GDPR or a trade secret within the meaning of Article 2(1) of Directive 2016/943. In this case, too, this information must be transmitted to the competent supervisory authority or court, which must weigh the conflicting rights and interests in order to determine the scope of the data subject's right to access the personal data concerning him or her.

75 With regard to the need to determine this on a case-by-case basis, Article 15(1)(h) GDPR precludes, in particular, the application of a provision such as Section 4(6) of the Data Protection Act, which fundamentally excludes the data subject's right to information provided for in Article 15 of the GDPR if the information would jeopardize a business or trade secret of the controller or a third party. A Member State cannot definitively determine the outcome of a balancing of the conflicting rights and interests required by Union law and carried out on a case-by-case basis. prescribe (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C-634/21, EU:C:2023:957, paragraph 70 and the case-law cited therein).75 With regard to the need to determine this on a case-by-case basis, Article 15(1)(h) GDPR precludes, in particular, the application of a provision such as paragraph 4(6) of the Data Protection Act, which fundamentally excludes the data subject's right of information provided for in Article 15 GDPR if the information would jeopardise a business or trade secret of the controller or a third party. A Member State cannot conclusively prescribe the outcome of a balancing of the conflicting rights and interests prescribed by Union law and carried out on a case-by-case basis. See, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring), C-634/21, EU:C:2023:957, paragraph 70 and the case-law cited therein).

76 In view of the foregoing, the answer to questions 3(b), 3(c), 4(a) and 4(b), as well as to the fifth and sixth questions, is that Article 15(1)(h) of the GDPR must be interpreted as meaning that, where the controller considers that the information to be communicated to the data subject pursuant to that provision includes third-party data protected by the GDPR or trade secrets within the meaning of Article 2(1) of Directive 2016/943, the controller must transmit that allegedly protected information to the competent supervisory authority or court, which must weigh the competing rights and interests in order to determine the scope of the data subject’s right of access provided for in Article 15 of the GDPR.’76 In view of the foregoing, the answer to questions 3(b), 3(c), 4(a) and 4(b), as well as to the fifth and sixth questions, is that Article 15(1)(h) of the GDPR must be interpreted as meaning that, Paragraph 1(h) of the GDPR is to be interpreted as meaning that, where the controller considers that the information to be communicated to the data subject pursuant to that provision includes third-party data protected by the GDPR or trade secrets within the meaning of Article 2(1) of Directive 2016/943, the controller must transmit that allegedly protected information to the competent supervisory authority or court, which must weigh the competing rights and interests in order to determine the scope of the data subject's right of access provided for in Article 15 of the GDPR."

31 According to these cited statements of the ECJ, when assessing the scope of the right of information granted to a data subject by automated processing of their personal data under Article 15(1)(h) GDPR, with regard to the protection of trade secrets within the meaning of Article 2(1) of Directive 2016/943, without prejudice to Section 4(6) of the Data Protection Act (DSG), the right of information must be weighed against the protection of trade secrets in each individual case.

32 The fact that the calculation method developed by the party appealing the appeal and used to determine the score constitutes a trade secret within the meaning of Article 2(1) of Directive 2016/943 has not been questioned by the authority under appeal, the administrative court, or the other party involved.

33 Automated processing of personal data for the purpose of determining a credit profile can have serious consequences for the economic life of a data subject, such as exclusion from or restriction of access to credit (see Guidelines of the Data Protection Working Party established by Article 29 of Directive 95/46/EC on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, adopted on October 3, 2017, as revised and adopted on February 6, 2018, WP251rev.01, pp. 23 et seq., 28 et seq.). In this respect, the right to information pursuant to Article 15(1)(h) GDPR is particularly important with regard to the exercise of the rights conferred on the data subject. Accordingly, the mere reference to a possible threat to a trade secret cannot result in the nature of the automated processing remaining unclear to the data subject – as in the present case – and in the data subject being essentially prevented from reviewing the procedure and principles of automated processing for the purpose of exercising the rights conferred on him or her under the GDPR.

34 In the present case, in fulfilling its obligation to provide information pursuant to Article 15(1)(h) GDPR, as set out above, the party appealing for an appeal must explain to the co-participant the nature of the automated processing of the personal data of the co-participant, specifically with regard to the significance of the processed personal data for the "score" calculated for the co-participant, in order to ensure that the co-participant can exercise its rights, in particular those under Article 22(3) GDPR. However, there is no need for a detailed explanation of the algorithms used or for disclosure of the entire algorithm (see again ECJ 27.2.2025, C-203/22, Dun & Bradstreet Austria, para. 60).

35 Based on this scope of the necessary explanations regarding the nature and method of the automated processing of the personal data of the co-participants, it is not apparent, however, that this necessarily discloses the trade secret asserted by the party appealing the appeal regarding the general calculation method ("score formula"). To the extent that the party appealing the appeal refers in this context to the judgment of the German Federal Court of Justice of 28 January 2014, VI ZR 156/13, this decision is of no significance, not least because it was issued under the old legal situation of Directive 95/46/EC and its domestic implementation in the Federal Republic of Germany through the German Federal Data Protection Act (BDSG).

36 In summary, the party appealing the appeal has not demonstrated in its appeal that the Administrative Court unlawfully found a violation of the co-participants' right to information under Article 15 (1) (h) GDPR with regard to the "involved logic" applied in calculating the co-participants' "score."

Result

37 The appeal was therefore dismissed as unfounded pursuant to Section 42 (1) of the Administrative Court Act (VwGG).

38 Regarding the suggestion by the party appealing the appeal to refer the question of what meaningful information about the logic involved in automated decision-making must be made available to a data subject by the controller pursuant to Article 15(1)(h) GDPR to the ECJ for a preliminary ruling, reference is made to the ECJ's judgment of February 27, 2025, C-203/22, Dun & Bradstreet Austria, cited above.

39 The decision on reimbursement of expenses is based on Sections 47 et seq. of the Administrative Court Act (VwGG) in conjunction with the Administrative Court Expenses Reimbursement Ordinance 2014.

Vienna, August 20, 2025

@@ Line 1: / Line 1: @@
+[[Category:VwGH (Austria)]]
 {{COURTdecisionBOX
@@ Line 25: / Line 26: @@
 |Year=2025
-|GDPR_Article_1=Article 22 GDPR
+|GDPR_Article_1=Article 15(1)(h) GDPR
-|GDPR_Article_Link_1=Article 22 GDPR
+|GDPR_Article_Link_1=Article 15 GDPR#(h) Information about automated decision-making
-|GDPR_Article_2=
+|GDPR_Article_2=Article 22 GDPR
-|GDPR_Article_Link_2=
+|GDPR_Article_Link_2=Article 22 GDPR
 |GDPR_Article_3=
 |GDPR_Article_Link_3=
@@ Line 49: / Line 50: @@
 |Party_Link_3=
-|Appeal_From_Body=Bundesverwaltungsgericht (Federal Administrative Court)
+|Appeal_From_Body=BVwG (Austria)
-|Appeal_From_Case_Number_Name=W256 2256406-1/11E
+|Appeal_From_Case_Number_Name=Zl. W256 2217011-1/11E
 |Appeal_From_Status=
 |Appeal_From_Link=
@@ Line 62: / Line 63: @@
 }}
-The Austrian Administrative Court held that [[Article 22 GDPR|Article 22 GDPR]] requires a case-specific, contextual assessment of whether credit scoring constitutes solely automated decision-making and is not an absolute right triggered by algorithmic processing.
+The Supreme Administrative Court held that a credit information agency violated Article 15(1)(h) GDPR by failing to provide meaningful information about the logic and weighting of factors in its automated credit scoring process. Further, the Court found that the existence of trade secrets could not justify the refusal to provide such information.
 == English Summary ==
 === Facts ===
-The data subject lodged a complaint with the Austrian Data Protection Authority (DSB) against Dun & Bradstreet Austria GmbH, a credit information agency, claiming that the controller’s credit scoring system amounted to unlawful automated decision-making under [[Article 22 GDPR|Article 22 GDPR]].
+The data subject submitted an access request under [[Article 15 GDPR]] to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed.
-The DSB dismissed the complaint, finding that the generated score was only one of several factors considered by the controller and therefore did not constitute a “solely automated decision.”
+The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates.
-The Federal Administrative Court (BVwG) upheld the DSB’s decision, reasoning that the credit score did not independently determine lending outcomes and that [[Article 22 GDPR|Article 22 GDPR]] was therefore not applicable.
+The DSB partially upheld the complaint for violation of the right of access under [[Article 15 GDPR]] by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making.
-The data subject appealed to the Austrian Administrative Court (VwGH), arguing that the DSB and BVwG had failed to adequately assess the functioning and practical effect of the scoring process. The data subject referred to the CJEU’s judgments in [[CJEU - C‑203/22 - Dun and Bradstreet Austria|Dun & Bradstreet Austria]] and [[CJEU - C‑26/22 and C‑64/22 - SCHUFA Holding and Others (Discharge from remaining debts) (Joined Cases)|SCHUFA Holding AG]], which clarified that automated credit scoring may fall under [[Article 22 GDPR|Article 22 GDPR]] when it produces legal or similarly significant effects on individuals.
+The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated [[Article 15 GDPR|Article 15(1)(h) GDPR]] by not providing sufficient information about the logic of automated processing and weighting of factors.
-The appeal sought annulment of the BVwG’s decision and a reassessment of whether the credit scoring constituted “solely automated decision-making” within the meaning of [[Article 22 GDPR#1|Article 22(1) GDPR]].
+The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in [[CJEU - C‑634/21 - SCHUFA Holding (Scoring)|SCHUFA Holding (Germany)]] and [[CJEU - C‑203/22 - Dun and Bradstreet Austria|Dun & Bradstreet Austria (Austria)]], which dealt with similar issues around credit scoring and automated processing under GDPR.
 === Holding ===
-The Austrian Administrative Court (VwGH) annulled the decision of the Federal Administrative Court (BVwG), holding that both the BVwG and the DSB  had failed to adequately assess whether the credit-scoring process operated by the controller constituted solely automated decision-making under [[Article 22 GDPR#1|Article 22(1) GDPR]].
+The Austrian Supreme Administrative Court (BVwG) dismissed the appeal.
-The Court upheld the reasoning of the CJEU case law, affirming that [[Article 22 GDPR|Article 22 GDPR]] does not confer an absolute right automatically triggered by algorithmic processing. Instead, it requires a context-specific evaluation of whether the automated output produces legal effects or similarly significant consequences for the data subject. The Court further held that Articles 13(2)(f), 14(2)(g) and 15(1)(h) GDPR require controllers engaged in profiling or credit-scoring to provide data subjects with meaningful information on the logic involved, as part of their transparency obligations under Article 12 GDPR.
+Under [[Article 15 GDPR|Article 15(1)(h) GDPR]], data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in [[Article 22 GDPR|Article 22(1) GDPR]] must exist.
-Accordingly, the Court ordered the DSB to reopen the investigation and determine whether the information provided by Dun & Bradstreet met the standard of Article 15 GDPR, specifically assessing whether it produced legal effects or similarly significant consequences for the data subject within the meaning of [[Article 22 GDPR#1|Article 22(1) GDPR]].
+The VwGH held that it was undisputed in this case that an automated decision, a credit score, had been made and the credit information agency violated the data subject’s right to receive meaningful information under [[Article 15 GDPR|Article 15(1)(h) GDPR,]] since the provided information was too vague, It did not explain the impact of specific data points on the score and it used general statements like  without clarifying what this means or how it affected the result.
+Under [[CJEU - C‑634/21 - SCHUFA Holding (Scoring)|SCHUFA Holding]] & [[CJEU - C‑203/22 - Dun and Bradstreet Austria|Dun & Bradstreet Austria]] meaningful information must be precise, transparent, understandable, easily accessible, and must allow the data subject to, understand how their data was used, know which data had which influence, and challenge the outcome.
+Regarding the claim by the credit information agency that it couldn't disclose more details about how it calculated the individual’s score because the method was protected as a trade secret, the VwGH argued that the scoring method may indeed be a protected trade secret, however, the data subject has a strong right to understand the logic and influence of personal data in automated decision-making, especially because credit scores can significantly affect a person's economic life.
+In this case, the credit information agency did not demonstrate that explaining which factors were used and how they influenced the score would necessarily reveal the secret formula.
+Under relevant [[CJEU - C‑203/22 - Dun and Bradstreet Austria|CJEU case law]] the GDPR rights are not absolute but the mere existence of a trade secret cannot justify a complete refusal to provide any access. A specific, balanced assessment must take place. Therefore, [[Article 15 GDPR|Article 15(1)(h) GDPR]] still applies even when trade secrets are involved.
 == Comment ==
-The decision aligns with recent CJEU guidance on automated decision-making, reaffirming that authorities must assess the functional impact of algorithmic tools rather than their formal classification. It clarifies that [[Article 22 GDPR|Article 22 GDPR]] applies where an automated output meaningfully determines an outcome for the data subject, even if embedded within a broader process.
 == Further Resources ==