BVwG - W256 2233303-1
From GDPRhub
| BVwG - W256 2233303-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(7) GDPR Article 12 GDPR Article 15 GDPR Article 15(1)(h) GDPR Article 22(1) GDPR |
| Decided: | 19.03.2026 |
| Published: | 27.04.2026 |
| Parties: | Unnamed data subject Credit information agency (controller) |
| National Case Number/Name: | W256 2233303-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2026:W256.2233303.1.00 |
| Appeal from: | DSB (Austria) 2020-0.011.179 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | Ava Lang |
A court held that a credit information agency did not have to provide access to the logic involved in the calculation of credit scores since those scores were not disclosed to third parties. According to the court, Article 22 GDPR did not apply since the scores had no effect on the data subject.
English Summary
Facts
The data subject requested access from a credit information agency (the controller). On 23 February 2019, the controller provided information under Article 15 GDPR, including personal data and three credit scores (Risk Indicator, Economic Index, and KKE score).
The data subject argued that the response was incomplete, particularly regarding the origin of the data and the logic behind the credit scoring.
The controller maintained that it had provided sufficient information, including data sources. It also argued that further details on scoring logic were protected as trade secrets and that the scores had not been disclosed to third parties.
The DPA partially upheld the complaint. It found that the access response was incomplete and ordered the controller to provide more detailed information on the logic of the credit scoring.
The controller appealed and assured that the scores had neither been shared with third parties nor had any effect on the data subject. The data subject could not substantiate any actual impact of the scores.
Holding
First, the court assessed the scope of Article 15(1)(h) GDPR. It clarified that the obligation to provide meaningful information about the logic of processing applies at least where Article 22 GDPR is triggered.
Second, the court relied on case law of the Court of Justice of the European Union to determine that Article 22 GDPR requires three elements: a decision, based solely on automated processing, that produces legal effects or similarly significant effects for the data subject.
Third, the court held that while the credit scoring constituted automated processing and could qualify as a “decision”, it did not meet the third requirement. The controller had not disclosed the scores to third parties, and the scores had no impact on the data subject.
Therefore, the court concluded that Article 22 GDPR did not apply. As a result, the additional transparency obligations under Article 15(1)(h) GDPR were not triggered.
Finally, the court held that the controller had fulfilled its obligations under Article 15 GDPR. It annulled the DPA’s decision and rejected the data subject’s complaint in full.
Comment
The referenced CJEU decisions are C-203/22 and C-634/21.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date March 19, 2026 Legal Norm Federal Constitutional Law (B-VG) Art. 133 para. 4 GDPR Art. 12 GDPR Art. 15 GDPR Art. 15 para. 1 lit. GDPR Art. 22 para. 1 GDPR Art. 4 no. 7 Federal Constitutional Law (B-VG) Art. 133 today; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from Article 133 of the Federal Constitutional Law (B-VG) valid from 1 August 2014 to 24 May 2018, last amended by Federal Law Gazette I No. 164/2013; Article 133 valid from 1 January 2014 to 31 July 2014, last amended by Federal Law Gazette I No. 51/2012; Article 133 valid from 1 January 2004 to 31 December 2013, last amended by Federal Law Gazette I No. 100/2003; Article 133 valid from 1 January 1975 to 31 December 2003, last amended by Federal Law Gazette No. 444/1974; Article 133 valid from 25 December 1946 to 31 December 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946, last amended by Federal Law Gazette No. 4/1945. B-VG Art. 133 valid from January 3, 1930 to June 30, 1934. Ruling W256 2233303-1/33E In the name of the Republic The Federal Administrative Court, composed of Judge Caroline Kimm, presiding, and lay judges Dr. Claudia Rosenmayr-Klemenz and Mag. Adriana Mandl, as lay judges, have ruled on the appeal of XXXX, represented by Putz & Rischka Rechtsanwälte KG, against points 1 and 2b of the decision of the Data Protection Authority dated March 16, 2020, file no. 2020-0.011.179, concerning access to information pursuant to Article 15 GDPR, as follows: The Federal Administrative Court, composed of Judge Mag. Caroline KIMM as presiding judge and lay judges Dr. Claudia Rosenmayr-Klemenz and Mag. Adriana Mandl, as lay judges, has ruled on the appeal of [Company Name], represented by Putz & Rischka Rechtsanwälte KG, against points 1 and 2b of the decision of the Data Protection Authority dated March 16, 2020, file no. 2020-0.011.179, concerning access to information pursuant to Article 15 GDPR, as follows: A) The appeal against points 1 and 2b. The appeal is granted and the ruling of the contested decision is amended to read in its entirety: "The data protection complaint is dismissed as unfounded." B) The appeal on points of law is inadmissible pursuant to Article 133, paragraph 4, of the Austrian Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Procedural History: In her complaint of May 16, 2019, XXXX (hereinafter: co-respondent) alleged a violation of her right to information. She had requested a free self-disclosure report from the appellant. However, the information provided was deficient, among other things, with regard to the origin of the data and the methodology used to determine a credit rating. In her complaint of May 16, 2019, Roman numeral 40 (hereinafter: co-respondent) alleged a violation of her right to information. She had requested a free self-disclosure report from the complainant. However, the information provided was deficient, particularly regarding the origin of the data and how the credit rating was determined. In her statement of September 4, 2019, the complainant explained that she had provided the co-respondent with clear and GDPR-compliant information, including details about the origin of the data. Therefore, the complainant had not violated any data protection laws. Regarding the co-respondent's objection to the credit rating, it should be noted that such ratings are issued by the complainant in her capacity as a commercial credit reporting agency. The criteria were sufficiently disclosed to the co-respondent, and the disclosure of further criteria is not intended and is subject to the complainant's trade secrets. Furthermore, the credit ratings obtained for the co-respondent were not shared with any third parties. The co-respondent did not comment on this during the hearing. The contested decision partially upheld the appeal of the co-respondent and determined that the information provided was incomplete (Point 1). Point 2a. therefore instructed the appellant to verify whether further information existed regarding the origin of the co-respondent's data and, if so, to provide the co-respondent with the corresponding information. Point 2b. further instructed the appellant to provide the co-respondent with meaningful information about the logic involved in the credit rating concerning them. The co-respondent's appeal was otherwise dismissed in Point 3. In its reasoning, the respondent authority stated – insofar as relevant here – that the appellant makes automated individual decisions, particularly since it conducts credit checks. Due to the lack of any other meaningful information suitable for clarifying how the credit scores were calculated, the complainant deprived the other party of the opportunity to understand how the credit ratings assigned to it were determined. The complainant also failed to adequately demonstrate how providing meaningful information about the logic of automated decision-making constituted a trade secret in this specific case. The complainant is therefore obligated to provide meaningful information about the logic involved. This appeal is directed against that decision. The complainant has provided complete information in accordance with the GDPR, including information regarding the origin of the data. Regarding points 1 and 2b of the ruling... The complainant argued, in summary, that there was no right to information under Article 15(1)(h) GDPR against the complainant because the complainant did not make a decision based solely on automated processing within the meaning of Article 22(1) GDPR, the complainant's calculation of creditworthiness had no legal effects on data subjects, nor did it significantly affect them in a similar way, especially since, in the present case, the score values were not even forwarded to third parties. The present appeal is directed against this decision. The complainant claims to have provided complete information in accordance with the GDPR, including information regarding the origin of the data. Regarding points 1 and 2b of the ruling... The complainant argued, in summary, that there was no right to information under Article 15(1)(h) GDPR against the complainant because it did not make a decision based solely on automated processing within the meaning of Article 22(1) GDPR, the complainant's calculation of creditworthiness had no legal effect on data subjects, nor did it significantly affect them in a similar way, especially since, in the present case, the score values were not even forwarded to third parties. By (uncontested) (partial) ruling of September 12, 2022, W256 2233303-1/8E, the complaint against point 2a was upheld and this point was set aside without substitution. At the same time, the proceedings regarding points 1 and 2b were discontinued. The proceedings were suspended pending the preliminary ruling of the Court of Justice of the European Union (CJEU) in cases C-203/22 and C-634/21 pursuant to Section 17 of the Administrative Court Procedure Act (VwGVG) in conjunction with Section 38 of the General Administrative Procedure Act (AVG). By (uncontested) (partial) decision of September 12, 2022, W256 2233303-1/8E, the appeal against point 2a was granted and this point was quashed without substitution. At the same time, the proceedings with regard to points 1 and 2b were suspended pending the preliminary ruling of the CJEU in cases C-203/22 and C-634/21 pursuant to Section 17 of the VwGVG in conjunction with Section 38 of the AVG. The CJEU issued its judgment in case C-634/21 on December 7, 2023, and its judgment in case C-203/22 on February 27, 2025. In her statement of July 9, 2025, the complainant essentially reiterated her previous arguments, namely that in the present case, the available credit scores had not been passed on or disclosed to any third parties. The co-respondent also failed to cite any specific instance of a (negative) decision with legal effect in her appeal. In response, the co-respondent stated in her letter of September 21, 2025, that the fact that "allegedly" no specific scores had been transmitted to third parties did not alter the existence of the right to information. She argued that it should be taken into account that the specific information used in a credit assessment was already available. Therefore, the weighting of this information should be disclosed. Regarding any potential (negative) consequences, she noted that she had been looking for an apartment at the time and had indeed been rejected twice. (Negative) effects would not, moreover, constitute a prerequisite for the applicability of Article 22 GDPR, especially since such effects would only become apparent subsequently. Whether a decision within the meaning of Article 22 GDPR exists cannot depend on circumstances that only become apparent later. Article 14(2)(g) GDPR, for example, would never be applicable under such an interpretation. Accordingly, the CJEU also holds that a credit rating falls under Article 22 GDPR if the decisive factor in whether a third party, to whom this probability value is transmitted, enters into, performs, or terminates a contractual relationship with that person depends on this probability value. This is also the case if the contract is established – i.e., concluded. A right of access under Article 15(1)(h) GDPR also exists outside the scope of Article 22 GDPR, for example, in cases of profiling. This can be inferred from the wording "at least in these cases" in Article 15(1)(h) GDPR. In her letter of September 21, 2025, the co-respondent argued that the fact that "allegedly" no concrete scores had been transmitted to third parties did not alter the existence of the right to information. She maintained that the fact that the specific information used in a credit assessment was already available should be taken into account. Therefore, the weighting of this information should be disclosed. Regarding any potential (negative) consequences, she stated that she was looking for an apartment at the time and had indeed been rejected twice. Moreover, (negative) consequences were not a prerequisite for the applicability of Article 22 of the GDPR, especially since such consequences would only become apparent subsequently. Whether a decision within the meaning of Article 22 of the GDPR exists cannot depend on circumstances that only emerge after the fact. Article 14, paragraph 2, letter g of the GDPR, for example, would never be applicable under such an interpretation. Accordingly, the CJEU also holds that a credit rating falls under Article 22 of the GDPR if whether a third party, to whom this probability value is transmitted, enters into, performs, or terminates a contractual relationship with that person depends significantly on this probability value. This is also the case when the contract is established – i.e., concluded. A right of access under Article 15(1)(h) of the GDPR also exists outside the scope of Article 22 of the GDPR, for example, in cases of profiling. This can be inferred from the wording "at least in these cases" in Article 15(1)(h) of the GDPR. At the court's request, the co-respondent stated in her letter of February 10, 2026, that she could not provide any further details regarding her apartment search at that time, and therefore could not comment on whether the existing credit scores had had any (negative) impact on it. However, this was not decisive, as—as she had already explained—it was irrelevant. II. The Federal Administrative Court considered the following: 1. Facts: The appellant operates a credit reporting agency pursuant to Section 152 of the Trade Regulation Act, which, among other things, authorizes it to provide information on creditworthiness to third parties. The appellant operates a credit reporting agency pursuant to Section 152 of the Trade Regulation Act, which, among other things, authorizes it to provide information on creditworthiness to third parties. The complainant also uses automated processing to predict the probability of a payment default or payment irregularities and thus a person's creditworthiness based on the information available to it (so-called automatically calculated score values). Such score values are generated upon request and transmitted to third parties (contractual partners). At the request of the co-respondent, the complainant provided them with information pursuant to Article 15 of the GDPR by letter dated February 23, 2019. In this letter, the co-respondent was informed, among other things, that in addition to general data such as name, address, date of birth, etc., the complainant also processes three more detailed creditworthiness indicators for the co-respondent: a Risk Indicator, a Profitability Index, and a KKE Score. This information was provided to the co-respondent, among other things, that in addition to general data such as name, address, date of birth, etc., the complainant also processes three creditworthiness indicators for the co-respondent, namely a Risk Indicator, a Profitability Index, and a KKE Score. ``` These three ratings were neither disclosed to third parties by the appellant, nor did they otherwise have any effect on the co-respondent. 2. Evaluation of Evidence: The above-described course of proceedings and the established facts are derived from the administrative and court files and are essentially undisputed. Throughout the proceedings, the appellant consistently stated that the credit ratings were not disclosed to third parties, nor did they otherwise have any effect on the co-respondent, and this is consistent with the information she provided to the co-respondent. The co-respondent does not essentially dispute this lack of disclosure or these lack of effect. While she stated in the proceedings that the disclosure of her credit ratings was (only) "allegedly" not to have occurred, this does not alter the fact that the appellant's credit ratings were not disclosed. Despite the court's explicit request, the appellant failed to provide further details and, in particular, evidence demonstrating that, contrary to her assertions, her credit ratings had indeed been transmitted to third parties or that these ratings had had any other impact on her. Instead, she limited her arguments to the assertion that such disclosure or any (negative) impact was irrelevant. Given the apparently purely speculative assumption of the other parties that no disclosures had occurred, the court found no grounds to reject the appellant's consistent and coherent arguments on this matter. (The text abruptly shifts to a different topic:) 3. Legal Assessment: Regarding point A) The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; GDPR) read in part as follows: [Recital] (63) A data subject should have the right to access personal data concerning him or her that has been collected and to exercise this right easily and at reasonable intervals in order to be aware of the processing and to verify its lawfulness. [...] This right should not adversely affect the rights and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software. However, this should not result in the data subject being denied any access to information whatsoever. [...] [...] (71) The data subject should have the right not to be subject to any decision—which may include a measure—for the evaluation of to be subject to processing of personal data concerning them which is based solely on automated processing and which produces legal effects concerning them or similarly significantly affects them, such as the automatic rejection of an online loan application or online recruitment process without any human intervention. Such processing also includes ‘profiling’, which consists of any form of automated processing of personal data involving the evaluation of personal aspects relating to a natural person, in particular for the analysis or prediction of aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behavior, location or movements, insofar as this produces legal effects concerning them or similarly significantly affects them. [...] In any event, such processing should be accompanied by appropriate safeguards, including specific information for the data subject and the right to obtain direct human intervention, to express their point of view, to have the decision explained after such evaluation, and the right to contest the decision. In order to take into account the specific circumstances and context in which the personal data are processed, To ensure fair and transparent processing of personal data, the data controller should use appropriate mathematical or statistical methods for profiling, implement suitable technical and organizational measures, in particular to ensure that factors leading to inaccurate personal data are corrected and the risk of errors is minimized, and secure personal data in a manner that takes into account potential threats to the interests and rights of the data subject and, among other things, prevent processing that has discriminatory effects or produces discriminatory effects against natural persons on the grounds of race, ethnic origin, political opinion, religion or belief, trade union membership, genetic predisposition or health status, or sexual orientation. Automated decision-making and profiling based on special categories of personal data should only be permitted under specific conditions. [...] Article 4 Definitions [...] 7. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, controls the personal data The purposes and means of processing personal data are determined by Union or Member State law; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law; […] Article 12 Transparent information, communication, and modalities for the exercise of the data subject’s rights (1) The controller shall take appropriate measures to provide the data subject with all information referred to in Articles 13 and 14 and all communications referred to in Articles 15 to 22 and Article 34 relating to processing in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, in particular for information addressed specifically to children. The information shall be provided in writing or by other means, including, where appropriate, electronically. If requested by the data subject, the information may be given orally, provided that the data subject’s identity has been verified by other means. […] (2) The controller shall facilitate the exercise of the data subject’s rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller may refuse to act on the data subject’s request to exercise their rights under Articles 15 to 22 only if they can credibly demonstrate that they are unable to identify the data subject. (3) The controller shall provide the data subject with information on the measures taken in response to a request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. The controller shall inform the data subject of any extension of this period, together with the reasons for the delay, within one month of receipt of the request. Where the data subject makes the request electronically, the information shall be provided electronically where possible, unless the data subject requests otherwise. (4) Where the controller does not act on the request of the data subject, the controller shall inform the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not acting and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy. [..] Article 15 Right of access by the data subject (1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. […] Article 22 Automated individual decision-making, including profiling (1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. […] […] Article 15 of the GDPR grants the data subject the right to request detailed information from the respective controller. If personal data is being processed, the data subject can request information about the data itself, as well as a significant amount of information relating to the processing of this data (see Ehmann in Ehmann/Selmayr [eds], Datenschutz-Grundverordnung², Art. 15, para. 15). Article 15 of the GDPR grants the data subject the right to request detailed information from the respective controller. If personal data is being processed, the data subject can request information about the data itself, as well as a significant amount of information relating to the processing of this data (see Ehmann in Ehmann/Selmayr [eds], Datenschutz-Grundverordnung², Art. 15, para. 15). This includes, according to Article 15(1)(h) of the GDPR, the right to information about the existence of automated processing. Decision-making, including profiling, pursuant to Article 22(1) and (4), and—at least in these cases—the right to receive meaningful information about the logic involved, as well as the scope and intended effects of such processing for the data subject. This additional obligation to provide information is identical to the proactive obligation to provide information, i.e., the obligation to provide information without a corresponding request, under Article 13(2)(f) and Article 14(2)(g) GDPR. According to Article 15(1)(h) GDPR, this includes the right to information about the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4), and—at least in these cases—the right to receive meaningful information about the logic involved, as well as the scope and intended effects of such processing for the data subject. This additional obligation to provide information is identical to the proactive obligation to provide information, i.e., the obligation to provide information without a corresponding request, under Article 13(2)(f) and Article 14(2) GDPR. g, GDPR. Article 15(1)(h) GDPR (as well as Article 13(2)(f) and Article 14(2)(g) GDPR) thus clarifies that, in any case (“at least”) where automated decision-making pursuant to Article 22 GDPR is involved, the controller must provide additional information pursuant to Article 15(1)(h) GDPR. The assertion by the other party that such an obligation to provide information should also be extended to other automated processing operations outside the scope of Article 22 GDPR due to the phrase “at least in those cases” cannot be inferred from this provision and is consistent with Recital 71, which not only mentions the required “specific” information exclusively in connection with a decision pursuant to Article 22 GDPR, but also justifies it with the increased risks to data subjects associated with such a decision and the increased transparency required in this respect. Article 15(1)(h) of the GDPR (as well as Article 13(2)(f) and Article 14(2)(g) of the GDPR) thus clarifies that, in any case (“at least”) where automated decision-making pursuant to Article 22 of the GDPR is involved, the controller must provide additional information pursuant to Article 15(1)(h) of the GDPR. The assertion by the other party that such an obligation to provide information should also be extended to other automated processing operations outside the scope of Article 22 of the GDPR, based on the phrase “at least in those cases,” cannot be inferred from this provision and is consistent with Recital 71, which not only refers to the required “specific” information exclusively in connection with a decision pursuant to Article 22 of the GDPR, but also justifies it with the increased risks to data subjects associated with such a decision and the increased transparency required in that context. The interpretation of this provision is not supported by the argument made by the other party. Accordingly, the Court of Justice of the European Union (CJEU), in its judgment of 7 December 2023, C-634/21, paragraphs 56 et seq., also held, with reference to the enhanced protective purpose of Article 22 GDPR, that in the case of automated decision-making within the meaning of Article 22(1) GDPR, the controller is not only subject to additional information obligations under Article 13(2)(f) and Article 14(2)(g) GDPR, but the data subject is also granted an additional right of access under Article 15(1)(h) GDPR. Likewise, in its judgment of 27 February 2025, C-203/22, the CJEU held that, pursuant to Recital 71, if a data subject is subject to a decision based solely on automated processing which significantly affects him or her, he or she must have the right to have that decision explained. Referring to this case law of the ECJ, the Administrative Court (VwGH) also stated in its ruling of 17 December 2025, Ro 2023/04/0029, para. 5.2. It is explicitly clear that for a right of access under Article 15(1)(h) GDPR, an automated decision in an individual case pursuant to Article 22 GDPR is mandatory. Accordingly, the Court of Justice of the European Union (CJEU) also held in its judgment of 7 December 2023, C-634/21, paragraphs 56 et seq., referring to the increased protective purpose of Article 22 GDPR, that in the case of automated decision-making within the meaning of Article 22(1) GDPR, the controller is not only subject to additional information obligations under Article 13(2)(f) and Article 14(2)(g) GDPR, but the data subject is also granted an additional right of access under Article 15(1)(h) GDPR. Similarly, in its judgment of 27 February 2025, C-203/22, the CJEU held that, pursuant to Recital 71, if a data subject is subject to a decision based solely on automated processing which significantly affects them, they must have the right to have that decision explained. Referring to this CJEU case law, the Austrian Administrative Court (VwGH), in its ruling of 17 December 2025, Ro 2023/04/0029, para. 5.2, also explicitly clarified that a right of access under Article 15(1)(h) GDPR necessarily requires an automated decision in an individual case as defined in Article 22 GDPR. Regarding this case law of the CJEU, the Austrian Administrative Court (VwGH) also explicitly clarified in its decision of 17 December 2025, Ro 2023/04/0029, para. 5.2, that a right of access under Article 15(1)(h) GDPR necessarily requires an automated decision in an individual case as defined in Article 22 GDPR. ``` In its judgment of 7 December 2023, C-634/21, the CJEU already had to assess the question of whether the automated creation of a probability score based on personal data relating to a person, in relation to that person's ability to meet future payment obligations, by a credit reference agency, qualifies as an automated individual decision pursuant to Article 22(1) GDPR, if this probability score is decisive in determining whether a third party, to whom this probability score is transmitted, enters into, performs or terminates a contractual relationship with that person. In its judgment of 7 December 2023, C-634/21, the CJEU already had to assess the question of whether the automated creation of a probability score based on personal data relating to a person, in relation to that person's ability to meet future payment obligations, by a credit reference agency, qualifies as an automated individual decision within the meaning of Article 22(1) GDPR, if the decisive factor in determining whether a third party, to whom this probability score is transmitted, enters into, performs or terminates a contractual relationship with that person depends on that probability score. The CJEU held that the applicability of Article 22(1) GDPR depends on three cumulative conditions: first, that there must be a “decision”; second, that decision must be based solely on automated processing, including profiling; and third, that it must produce legal effects concerning the data subject or similarly significantly affect them (CJEU, 7 December 2023, C-634/21, paragraph 43). (ECJ, 7 December 2023, C-634/21, para. 43). Regarding the existence of a decision, the ECJ, referring to recital 71 and the Advocate General's Opinion, clarified that not only the granting or non-granting of credit, but also the assessment of personal aspects concerning an individual that may adversely affect them in various ways, including socially, must in itself qualify as a decision within the meaning of Article 22(1) GDPR. This includes the result of calculating an individual's ability to meet future payment obligations in the form of a probability score (Advocate General's Opinion, 16 March 2023, C-634/21, para. 38 and ECJ, 7 December 2023, C-634/21, para. 46). Regarding the existence of a decision, the CJEU, referring to recital 71 and the Advocate General's Opinion, clarified that not only the granting or non-granting of a loan, but also the assessment of personal aspects concerning an individual that may adversely affect them in various ways, including socially, qualifies as a decision within the meaning of Article 22(1) GDPR. This includes the result of calculating an individual's ability to meet future payment obligations in the form of a probability score (Advocate General's Opinion, 16 March 2023, C-634/21, paragraph 38 and CJEU, 7 December 2023, C-634/21, paragraph 46). This assessment must in itself qualify as a decision within the meaning of Article 22(1) GDPR. Regarding the second requirement that this decision must be “based exclusively on automated processing, including profiling,” the CJEU stated that the creditworthiness assessment in the present case was carried out exclusively automatically by the credit agency in the form of profiling within the meaning of Article 4(4) GDPR (CJEU, 07.12.2023, C-634/21, para. 47). In doing so, the CJEU explicitly relied on the Advocate General's opinion. In his opinion, the Advocate General stated that nothing in the statement of facts in the preliminary ruling indicated that, in addition to the mathematical and statistical procedures used by the credit agency, the score values were in any way significantly determined by an individual assessment and evaluation by a human being. Consequently, the Advocate General concluded that the determination of the score value, as an action of the credit reference agency, must be based "exclusively on automated processing" (Opinion of the Advocate General, 16 March 2023, C-634/21, paragraph 36). Regarding the second requirement that this decision must be "based exclusively on automated processing, including profiling," the CJEU stated that the creditworthiness assessment in the present case was carried out by the credit reference agency exclusively in an automated manner, specifically in the form of profiling within the meaning of Article 4(4) GDPR (CJEU, 7 December 2023, C-634/21, paragraph 47). In this respect, the CJEU explicitly relied on the Advocate General's observations. In his opinion, the Advocate General held that the statement of facts in the referral order contained no indication that, in addition to the mathematical and statistical procedures used by the credit reporting agency, the score values were in any way significantly determined by an individual assessment and evaluation by a human being. Consequently, the Advocate General concluded, the calculation of the score value as an action of the credit reporting agency was based “exclusively on automated processing” (Opinion of the Advocate General, 16 March 2023, C-634/21, paragraph 36). The Advocate General's statement of 16 March 2023, C-634/21, paragraph 36, must be considered. Regarding the third requirement, namely that the decision must have "legal effect" on the data subject or affect them "in a similar and significant way," the CJEU followed the Advocate General's opinion that the assessment of creditworthiness and the resulting granting or denial of credit constitutes a significant impairment for the data subject (CJEU, 07.12.2023, C-634/21, para. 48). In the present case, it is irrelevant that the granting or denial of credit lies not with the credit reference agency responsible for the credit score, but with a financial institution as a third party. The decisive factor—likely also in light of the requirement of "exclusively automated processing" stipulated in Article 22(1) GDPR—is solely that the credit reference agency's profiling-based credit score plays a decisive and thus crucial role in the financial institution's decision to grant credit agreements. This would be the case if, although a human being were involved in this credit award procedure, that person was unable to influence the causal link between the automated processing and the granting of the loan (Opinion of the Advocate General, 16 March 2023, C-634/21, paragraphs 41 and 44). With regard to the third requirement, namely that the decision must have "legal effect" on the data subject or affect them "in a similar and significant way," the CJEU also followed the Advocate General's Opinion, finding that the assessment of creditworthiness and the resulting granting or refusal of a loan constitutes a significant impairment for the data subject (CJEU, 7 December 2023, C-634/21, paragraph 48). In the present case, it is irrelevant that the granting or refusal of a loan is not the responsibility of the credit reporting agency responsible for the credit score, but rather of a financial institution as a third party. The decisive factor – likely also in light of the requirement of “exclusively automated processing” stipulated in Article 22(1) of the GDPR – is solely that the credit rating agency’s profiling-based score plays a decisive and thus crucial role in the financial institution’s decision to grant loans. This would be the case if a human being were involved in this granting procedure, but were unable to influence the causal link between the automated processing and the loan approval (Opinion of the Advocate General, 16 March 2023, C-634/21, paragraphs 41 and 44). In light of the CJEU’s reasoning, there is no doubt that the present automated assessment of the creditworthiness of the other parties involved qualifies as a “decision” within the meaning of Article 22 of the GDPR. Likewise, in the present case, there are no concerns, nor have any been raised in the entire proceedings, that this constitutes a purely automated assessment in the sense of profiling under Article 4(4) GDPR. Given the CJEU's rulings, it cannot be doubted that the present automated assessment of the creditworthiness of the parties involved qualifies as a "decision" within the meaning of Article 22 GDPR. Likewise, in the present case, there are no concerns, nor have any been raised in the entire proceedings, that this constitutes a purely automated assessment in the sense of profiling under Article 4(4) GDPR. ``` With regard to the third requirement under Article 22 GDPR outlined above, it must first be noted, based on the above explanations, that—as is also clear from the unambiguous statements in Recital 71—an automated assessment of personal aspects (“profiling”) can only be considered an automated decision under Article 22 GDPR if it produces legal effects concerning the data subject or similarly significantly affects them. In the present case, it is established that the assessment in question was neither disclosed to third parties nor did it otherwise affect or impact the other party in any way. Since the credit rating in question had no effect or other adverse impact on the other party involved, it cannot be considered an automated decision pursuant to Article 22 GDPR, as explained above. Therefore, the special right of access under Article 15(1)(h) GDPR did not apply in this case. It is established that the rating was neither disclosed to third parties nor did it otherwise have any effect or adverse impact on the other party involved. Since the credit rating in question had no effect or other adverse impact on the other party involved, it cannot be considered an automated decision pursuant to Article 22 GDPR, as explained above. Therefore, the special right of access under Article 15(1)(h) GDPR did not apply in this case. Since the assessment under review had no impact or impairment whatsoever on the other party, it was unnecessary to examine in detail the other party's argument that any form of impairment or effect, regardless of whether it was positive or negative, was sufficient for the applicability of Article 22 GDPR. Accordingly, it was also unnecessary to address the other party's statements regarding the applicability of Article 14(2)(g) GDPR in more detail. Since the assessment under review had no impact or impairment whatsoever on the other party, it was unnecessary to examine in detail the other party's argument that any form of impairment or effect, regardless of whether it was positive or negative, was sufficient for the applicability of Article 22 GDPR. Accordingly, it was not necessary to address in detail the arguments presented by the co-respondents regarding the applicability of Article 14, paragraph 2, letter g, GDPR. The data protection complaint would therefore have had to be dismissed (also) on this point, so that the appeal against points 1 and 2b of the decision should be granted and the ruling of the contested decision (taking into account the first-instance dismissal in point 3 and the already completed reversal of point 2a) should be amended to dismiss the data protection complaint in its entirety. Pursuant to Section 24, paragraph 1, of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio. Pursuant to Section 24, paragraph 1, of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio. Pursuant to Section 24 Paragraph 4 of the Administrative Court Procedure Act (VwGVG), unless otherwise provided by federal or state law, the Administrative Court may, irrespective of a party's request, dispense with a hearing if the case file indicates that an oral hearing would not provide any further clarification of the case, and neither Article 6 Paragraph 1 of the European Convention on Human Rights (ECHR) nor Article 47 of the Charter of Fundamental Rights of the European Union (CFR) precludes dispensing with a hearing. In the present case, the facts were clear from the case file and were not (substantively) contested. The taking of further evidence was not necessary to clarify the facts. Regarding B) Inadmissibility of the appeal: The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. The Federal Administrative Court was able to rely on relevant supreme court case law to resolve the question. The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. The Federal Administrative Court was able to rely on relevant supreme court case law to resolve the question.
