DSB (Austria) - D124.1994/24 2025-0.355.103
From GDPRhub
| DSB - D124.1994/24 2025-0.355.103 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 12 GDPR Article 13(2) GDPR Article 14(2)(g) GDPR Article 15(1)(g) GDPR Article 15(1)(c) GDPR Article 15(1)(h) GDPR Article 22(1) GDPR Article 22(2) GDPR Article 58(2)(f) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | 25.09.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | KSV Information GmbH go green Energy GmbH und Co KG |
| National Case Number/Name: | D124.1994/24 2025-0.355.103 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | German |
| Original Source: | DSB (in DE) |
| Initial Contributor: | xz |
The DPA held that a credit information agency violated the prohibition of automated individual decision-making (ADM) by calculating a data subject’s creditworthiness leading to an energy provider’s decision not to conclude a contract with the data subject. The energy provider’s rejection also constituted ADM but was considered necessary for entering into a contract.
English Summary
Facts
The data subject, via a service company, attempted to conclude an energy supply contract with a distribution company for electrical energy and gas (“energy provider”). After filling out the relevant form, the data subject first received a welcome email confirming him as a new customer within one minute, and immediately thereafter a message informing him that his application had been rejected for creditworthiness reasons. The rejection of the data subject's application was based on a credit score the energy provider requested from a credit information agency ("the credit information agency"). The entire process took place without the involvement of a natural person, and neither at the time of the alleged infringement nor at the time of the complaint did the privacy policies of either the energy provider or the credit information agency provide any information about the existence of such an automated decision.
The data subject subsequently submitted access requests to both controllers under Article 15 GDPR. However, both controllers provided incomplete information concerning the automated decision, including the logic involved, or the procedures and principles applied in the automated processing of the data subject’s personal data.
Following the data subject’s intervention, the energy provider offered to conclude an energy supply contract with the data subject on different terms, but, in the meantime, the data subject had felt compelled to enter into a less economically favorable contract with a competitor.
The data subject claimed violations of Article 13(2)(f) GDPR , Article 14(2)(g) GDPR, Article 15(1)(a) GDPRand Article 22(1) GDPR. The data subject also requested that the Austrian Data Protection Authority (DSB) order both controllers to provide a complete response under Article 15(1)(h) GDPR and to prohibit automated decision-making.
Holding
Holding concerning the credit information agency:
The DPA held that the credit information agency violated the data subject's rights under Article 22(1) GDPR by carrying out automated decision-making through the automatic calculation and transmission of a risk score. This score was used by the credit information agency as the decisive criterion for rejecting the data subject's application. The first controller could not rely on any exception under Article 22(2) GDPR.
As a result, the DPA prohibited the credit information agency , with immediate effect, from processing the data subject's personal data for the purpose of automatically calculating scoring values that provide information about his ability to meet future payment obligations or assess his solvency and creditworthiness, insofar as such scoring values are used for automated decision-making, including profiling, within the meaning of Article 22(1) GDPR, and the data subject has not consented to this processing. This prohibition is based on Article 58(2)(f) GDPR.
The credit information agency also violated the data subject's rights under Article 14(2)(g)GDPR by failing to provide the necessary information regarding the automated decision-making. The first controller’s privacy policy did not contain any such information at the time of the alleged infringement. Rather, the impression is given that only a calculated score value is transmitted and no decision is made. Nevertheless, this contradicts relevant CJEU case law concerning what constitutes an automated decision. It is irrelevant that the relevant CJEU judgment was delivered only after the time of the infringement, as, according to settled CJEU case law, its interpretation must be applied retroactively, and any conflicting national provisions must be disapplied.
Furthermore, the credit information agency also violated the data subject's right of access under Article 15(1)(c) GDPR, Article 15(1)(g) GDPR, and Article 15(1)(h) GDPR, because the information provided did not allow the data subject to assess whether the data processed was accurate. It was unclear which specific personal data and which mathematical-statistical principles were used to calculate the score. Contradictory statements regarding the data source further prevented the data subject from identifying the actual origin of his data. The data subject was also left completely in the dark regarding the recipients of his data.
This superficial and non-transparent form of information provision fails to meet the requirements of Article 15(1)(h) GDPR in conjunction with Article 12 GDPR. Consequently, tthe credit information agency is ordered to provide the complainant with complete, transparent, and comprehensible information under Article 15(1)(c) GDPR, Article 15(1)(g) GDPR, and Article 15(1)(h) GDPR within a period of four weeks.
Holding concerning the energy provider:
The DPA found no violation of Article 22 GDPR by the energy provider, as the processing was necessary for the conclusion of a contract between the controller and the data subject, and the automated decision was justified under Article 22(2) GDPR. Furthermore, the energy provider did not violate the data subject’s rights under Article 22(3) GDPR, as the data subject had the opportunity to present his point of view and was subsequently offered an alternative (albeit less economically favorable) tariff by the second controller. The application to prohibit the energy provider from processing data with regard to the automated decision on the conclusion of an energy supply contract under Article 58(2)(f) GDPR is rejected. Furthermore, the data subject's argument, that these rights were violated because they could only be exercised after the negative decision, was rejected.
As Article 12(3) GDPR explicitly provides, the controller must inform the data subject about the measures taken at their request under Articles 15 to 22 GDPR. This necessarily implies that the rights under Article 22(3) GDPR can only be asserted after a negative decision has been made.
The DPA held that the energy provider violated the data subject's rights under Article 13(2) GDPR and Article 14(2)(g) GDPR by failing to inform the data subject of the existence of automated decision-making, and by failing to provide meaningful and comprehensible information about the logic involved, as well as the scope and intended effects of the processing.
Additionally, the energy provider violated the data subject’s right under Article 15(1)(h) GDPR. The fact that an exception under Article 22 GDPR may apply, and that the processing was therefore lawful, does not exempt the controller from its obligation to provide information under Article 15 GDPR. Accordingly, the energy provider is ordered to provide the data subject with complete, transparent, and comprehensible information under Article 15(1) GDPR within a period of four weeks.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
The data protection authority decides on the data protection complaint of (complainant), represented by NOYB - European Center for Digital Rights, of 29 August 2024 against 1) KSV Information GmbH (first respondent/BG 1), represented by BLS Rechtsanwälte GmbH, and against 2) go green Energy GmbH und Co KG (second respondent/BG 2), represented by CMS Reich-Rohrwig Hainz Rechtsanwälte GmbH, on the grounds of a) an alleged infringement of the right not to be subject to a decision based solely on automated processing (Art. 22 GDPR), for b) an alleged infringement of the right of access under Art. 15 GDPR and for c) an alleged infringement of the rights under Art. 13 and 14 GDPR as follows: 1. The complaint against the first respondent is upheld and the following is a) By automatically established: calculating and transmitting the RiskIndicator , respondent violated the complainant 's right under Art. 22 para. 1 the first GDPR not to be subject to a decision based solely on automated processing of his personal data. b) 2 - The first respondent violated the complainant's right under Art. 14 para. 2 lit. g GDPR by not providing him with information on the existence of automated decision-making and meaningful and comprehensible information on the logic involved and the scope and intended effects of the processing. c) 2. The first respondent violated the complainant's right to information under Art. 15 para. 1 lit. c, lit. g and lit. h GDPR by not providing him with transparent, comprehensible and complete information on the origin of his data, the recipients of his data, the existence of automated decision-making and meaningful and comprehensible information on the logic involved and the scope and intended effects of the processing in response to his request of 16 January 2024. The complaint against the second respondent is upheld in part and the following findings are made: a) b) The second respondent thereby violated the complainant's right under Art. 13 para. 2 lit. f and Art. 14 para. 2 lit. g GDPR by not providing him with information on the existence of automated decision-making and meaningful and comprehensible information on the logic involved and the scope and intended effects of the processing. The second respondent has violated the complainant's right under Art. 15 para. 1 lit. h GDPR by not providing him with information on the existence of automated decision-making and meaningful and comprehensible information on the logic involved and the scope and intended effects of the processing at his request of December 15, 2023. 3. 4. The complaint against the second respondent due to an alleged violation of Art. 22 GDPR is dismissed as unfounded. The first respondent is prohibited with immediate effect from processing the complainant's personal data for the purpose of automatically calculating scoring values that provide information about his ability to meet future payment obligations or assess his solvency and creditworthiness, insofar as these scoring values are used for automated decision-making, including profiling, within the meaning of Art. 22 para. 1 GDPR and the complainant has not consented to this data processing. 3 - including profiling within the meaning of Art. 22 para. 1 GDPR and the complainant has not consented to this data processing. 5. 6. The application to prohibit the second respondent from processing data with regard to the automated decision on the conclusion of an energy supply contract is rejected. The first respondent is ordered to provide the complainant with complete, transparent and comprehensible information within the meaning of Art. 15 para. 1 lit. c, lit. g and lit. h GDPR within a period of 4 weeks, failing which the complainant will be executed. The information must meet the following requirements: It must comprehensibly disclose which specific personal data is used to calculate the scoring value and according to which mathematical-statistical principles.-- 7. It must make the significance of the individual input data for the calculation of the result transparent and explain how they influence the result. It must describe the possible effects of the scoring value on the decision on the conclusion, performance or termination of a contractual relationship for the data subject. The information must be provided in such a way that it is understandable and easily accessible to the average data subject. The second respondent is ordered to provide the complainant with complete, transparent and comprehensible information within the meaning of Art. 15 para. 1 lit. h GDPR within a period of 4 weeks, failing which the complainant will be executed. The requirements set out in section 6 must be met. Legal basis: Art. 12, Art. 13 para. 2 lit. f, Art. 14 para. 2 lit. g, Art. 15 para. 1 lit. c and lit. g -h, Art. 22, Art. 51 para. 1, Art. 57 para. 1 lit. f and Art. 77 para. 1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4.5.2016 p. 1; Sections 18 (1) and 24 (1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended. 4 - D E V E L O P M E N T A. Submissions of the parties and course of the proceedings Note from the data protection authority on the course of proceedings: The course of proceedings is not a legally binding element, but is optional. It is therefore generally not necessary to state the parties' submissions separately in the reasons for the decision (see Hengstschläger/Leeb, AVG § 60 Rz 22 (as of March 1, 2023, rdb.at)). The Data Protection Authority (DPA) will therefore limit itself to summarizing the main points of the submission and the statements of the respondents. A.1. In a submission initiating the proceedings dated August 29, 2024, the complainant (hereinafter: BF) lodged a complaint with the DSB and, to the extent relevant to the proceedings, submitted the following: on January 4, 2023, BF had commissioned a service provider to conclude supply contracts for electricity and gas on service provider attempted to its behalf . On October 17, 2023, the conclude such a supply contract with the second respondent (hereinafter: BG 2) on behalf of the BF. After filling out the relevant form, he first received a welcome email welcoming him as a new customer within a single minute and immediately afterwards a message that his application had been rejected for creditworthiness reasons. In the event of any questions, the BF should contact the first respondent (hereinafter: BG 1) directly. In the background, BG 2 had made a query of the BF with BG 1, which had reported a creditworthiness value of 403 regarding the "Risk Indicator" key figure from the business database. The BF was therefore rejected as a new customer solely on the basis of this value. Based on the entire process, which only took a few minutes from filling out the form to the rejection, it can be assumed that BG 2 is connected to the databases of BG 1 via an interface and that the entire process is fully automated without human intervention. 5 - without human intervention. However, no information about the existence of such an automated decision could be found in BG 2's privacy policy. The BF then submitted requests for information to both BGs within the meaning of Art. Art. 15 GDPR, which, in his opinion, were only inadequately answered. The BF accuses BG 1 of the following legal violations or infringements: Art. 14 para. 2 lit. g, Art. 15 para. 1 lit. c, lit. g and lit. h as well as Art. 22 para. 1 GDPR. With regard to BG 2, the BF alleges violations of Art. 13 para. 2 lit. f, Art. 14 para. 2 lit. g, Art. 15 para. 1 lit. h and Art. 22 para. 1 GDPR. The BF also requested that the DPA order both respondents to provide an answer regarding Art. 15(1)(h) and to prohibit automated decision-making in the present form. A.2. In a submission dated 5 November 2024, BG 2, through its legal representative, commented on the complaint and, in summary and to the extent relevant to the proceedings, stated the following: the rejection of the BF as a customer by BG 2 was not covered by Art. 22 GDPR, as the "significant effect" required for this was simply lacking in the present case. The BF had ultimately been offered a different energy supply contract by his service provider, which is why he had not suffered any disadvantage. Therefore, the BF was neither significantly affected nor did the refusal have any legal effect. Apart from this, any automated decision-making pursuant to Art. 22 para. 2 lit. a GDPR is permissible if it is necessary for the conclusion or performance of a contract. BG 2 receives up to 10,000 applications for the supply of energy per month; with such a volume, it is impossible to assess the creditworthiness of each individual applicant by human action. Nevertheless, the BF had also been granted the right to have the decision reviewed by a human being. His application was subsequently reviewed and he offered a different tariff. was With regard to the alleged violation of Art. 13 and Art. 14 or Art. 15 GDPR, BG 2 stated that there could be no such violation because, as explained above, the scope of Art. 22 GDPR did not apply. Therefore, the BF was not to be informed about the existence of an automated decision or the logic involved either in the data protection declaration or on the occasion of his request for information. A.3. In a letter dated November 18, 2024, BG 1, which was represented by a lawyer, also commented on the allegations made in the complaint as follows: it was responsible for the business database and processed the BF's personal data in this regard. However, a violation of Art. 22 GDPR could not be considered for the sole reason that BG 1 6 - only transmits creditworthiness information but has no power to decide whether a provider accepts a customer on the basis of this information or not. This is also apparent from the letter from BG 2 to the BF, in which reference is only made to BG 1 with regard to the creditworthiness data, but the rejection was explicitly made by BG 2. The BF had also been provided with complete information within the meaning of Art. Art. 15 GDPR had been provided. BG 1 interpreted the wording in the BF's letter dated February 18, 2024, according to which he would "have incorrect or incomplete data corrected by way of legal action" as a request for correction. The BF's score was therefore manually checked again and redetermined (DPO's note: lower and therefore better). Furthermore, it was stated that there could be no violation of Art. 14 para. 2 lit. g GDPR, as the credit rating was carried out before the judgment of the ECJ of December 7, 2023 (C-634/21) and, apart from that, the rating was a "simple recommendation" but not a decision. The decision was made solely by BG 2 and the company had no influence on its criteria. Finally, with regard to Art. 15 GDPR, it was stated that the specific calculation method for scoring was a business secret that was not to be disclosed. The BF only has the right to be informed of the principle on which the calculation is based. A.4. Following a separate request by the DPO, BG 1 again explicitly commented in a letter dated March 31, 2025 on the question of whether it would like to supplement or expand the statement issued in light of the ECJ ruling of February 27, 2025 (C-203/22) on the interpretation of Art. 15 para. 1 lit. h in conjunction with Art. 22 GDPR. BG 1 stated, mutatis mutandis, that the constellation in the judgment referred to differs from the present case. It was also of the opinion that the logic involved had been presented precisely and plausibly while protecting business secrets. A.5. All of the BG's statements were The BF also made use the parties on each occasion. B. Subject matter of the appeal made available to the BF as part of the hearing of the parties. of the opportunity to submit its own comments in the course of the hearing of Based on the submissions of the parties to the proceedings, the subject matter of the appeal therefore consists of the following questions: 1. Did BG 2 violate the BF's right pursuant to Art. 22 para. 1 GDPR not to be subject to a decision based solely on automated processing - including profiling? 2. 7 - Has BG 2 breached its duty to inform the BF in accordance with Art. 13 para. 2 lit. f and Art. 14 para. 2 lit. g GDPR by not providing him with information about the existence of automated decision-making and meaningful information about the 3. 4. 5. logic involved? Did BG 2 violate the BF's right under Art. 15 para. 1 lit. h GDPR by not providing him with information on the existence of automated decision-making and meaningful information on the logic involved at his request? Did BG 1 violate the BF's right under Art. 22 para. 1 GDPR not to be subject to a decision based solely on automated processing, including profiling? Has BG 1 breached its duty to inform the BF in accordance with Art. 14 para. 2 lit. g GDPR by not providing him with information on the existence of automated 6. decision-making and meaningful information on the logic involved? Has BG 1 violated the BF's right under Art. 15 para. 1 lit. h GDPR by not providing him with information on the existence of automated decision-making and meaningful information on the logic involved at his request? 7. Did BG 1 violate the BF's rights under Art. 15 para. 1 lit. c and lit. g GDPR by not providing him with information about the recipients or the origin of his personal C. Findings of the facts C.1. data? BG 1 carries out the business of a credit agency in accordance with Section 152 of the German Trade Regulation Act (GewO) and operates the data application "Business Database". Personal data of the BF is processed in the aforementioned data application. In the business database, the key figure "RiskIndicator" is calculated automatically on the basis of the information available there. For the The BF's RiskIndicator reported a value of on the day of the attempted contract conclusion, which corresponds to a probability of for a payment default. Following intervention by the BF, BG 1 recalculated the value of the RiskIndicator and set it at . This now only corresponds to a probability of for a payment default. BG 2 is a distribution company for electrical energy and gas. 8 Worthiness of evidence. The finding is based on the respective submissions of the BG and the official knowledge of the authority, as both companies may be considered to be known to the public in Austria. The determination of the automated calculation results from the information provided by BG 1 to the BF. Although it is stated there that two of the variables represent the personal assessment of a person, it is limited to the fact that not filling in \/ariabIes has no influence on the score value (maW: the score value can also be calculated completely automatically without the input of a person). In the present case, the DSB comes to the evidentiary conclusion that the risk indicator is calculated completely automatically and that human intervention is limited to a non-mandatory option that is not relevant to the decision. The calculation or decision is therefore not subject to any real supervision, as required, for example, in the guidelines of the Article 29 Working Party (see Guidelines on automated individual decision making, including profiling, for the purposes of Regulation 2016/679, WP251rev.01, p 22). C.2. On October 17, 2023, the BF (via a service company) attempted to conclude an energy supply contract with BG 2 on its website www.wasserkraft.at. Filling out the relevant forms took from 13:25 to 13:28. One minute later (at 13:29), the BF received a message welcoming him as a new customer of BG 2. Another minute later, at 13:30, BG 2 informed the BF that his application would be rejected due to an insufficient credit rating as part of a standard verification procedure with the Austrian Credit Protection Association. Subject: Warmly welcome km mnien From: U' sei e Was serkraft <sei vicega+\\fgsserki oft.at> banner uwk Welcome to Unsere Wasserkraft! We are delighted to welcome you as our customer and that you are starting a clean future with us. Fig.: Welcome message from BG 2 9 Subject: Rejection of your application for energy supply From: Our hydropower <service@wasserkraft.at> Date: You don't notice a difference. Nature does. Thank you for your interest in being supplied by Unsere Wasserkraft. Unfortunately, based on the results of our standard verification procedure with the Austrian Credit Protection Association, we have to reject your application for energy supply due to an inadequate credit rating. If you have any questions, please contact KSV1870 Information GmbH directly. Fig.: Message about the rejection of BF's application by BG 2. As can be seen, this was sent only one minute after the welcome message. Evaluation of evidence: The finding is based on the concurring preliminary submissions of the parties to the proceedings, including the undisputed a/rien/age. C.3. The rejection of the BF's application (see point C.2.) was made following an automated request from BG 2 to BG 1 and the resulting return transmission of the "Risk Indicator" key figure. The reason for the rejection as a customer was the transmitted value (score value) for the "Risk Indicator". The entire process took place without the intervention of a natural person. BG 2 receives between 6,000 and 10,000 online applications for the supply of energy per month.---- (8)- - ----- -- - , Exactly such a typical case of "m4angsfall" also exists from the point of view of the 10.QI0 E'cergie1iefervezträg (and partly even o'cbr) conclusion It is fitrd the bescbwerdegaeria daberscb1icbtuozoög1icb, the f/abescbadet of the esorbitaat bob'm resourceceneiosatz, dea eioe Boaitstspmtüag vmzrsacbm s'ürdc, wgre the Zwcifbdctagte in eioe'n sokten Fck Fig. Excerpt from the BG 2 statement dated November 5, 2024. 10 - Evaluation of evidence: The finding regarding the course of the application and the rejection is based on the submissions of the parties to the proceedings, which are essentially the same. The number of online applications per month for the supply of energy is taken from BG 2's statement of November 5, 2024, which the DSB considers credible. The statement that this process takes place without human intervention also results from the above-mentioned opinion of BG 2 and can only realistically be presented in this way due to the chronological sequence described under point C.2. An examination of submitted documents, a database query, the decision as to whether a customer is rejected or not and the writing of a corresponding message cannot possibly be carried out by a natural person in the space of one minute. C.4. Following the BF's intervention, BG 2 offered to conclude an energy supply contract with the BF on different terms in a letter dated January 10, 2024. Due to the long time lag between the unsuccessful attempt to conclude an energy supply contract and this alternative offer, the BF felt compelled in the meantime to conclude a less economically favorable contract with a competitor. Evaluation of evidence: The finding results from the consistent statements of the parties to the proceedings and the thus undisputed file situation. C.5. At the time of the infringement complained about or at the time of the complaint, BG 1's privacy policy did not contain any information about the existence of automated decision making. There are also no statements about the logic involved or the scope and intended effects of the processing. Rather, it is pointed out that the "assessment is made solely by the business partner". Fig.: Extract from BG 1's privacy policy valid at the time of the alleged infringement. Evaluation of evidence: The finding results from the BF's submission, which is not disputed in terms of content, and therefore the undisputed file situation. However, BG 1 stated that at the time of the alleged infringement, the decision of the ECJ of December 7, 2023 (C-634/21) was not yet available and it was therefore 11 - was not yet available and it was therefore not necessary at that time to disclose the relevant information. C.6. At the time of the alleged infringement or at the time of the complaint, BG 2's privacy policy did not contain any references to automated decision-making and the logic involved or the scope of the decision ( therefore no statements about see also point C.5.). Rather, the relevant section of the privacy policy deals with customer satisfaction and direct marketing. Fig.: Extract from the privacy policy of BG 2 at the time of the alleged infringement or at the time of the complaint. Evaluation of evidence: The finding results from the undisputed file situation. C.7. On January 16, 2024, the BF submitted a request for information pursuant to Art. 15 GDPR to BG 1, which replied by letter dated February 13, 2024 and March 19, 2024. The BF was informed as follows regarding the origin of his data (data sources): Fig.: Excerpts from the information provided to the BF on February 13, 2024 12 - In its statement of November 18, 2024, BG 1 also stated the following on the subject of data sources Fig.: Excerpt from the statement of BG 1 dated November 18, 2024, point 3.2. C.8. With regard to the recipients of the BF's personal data, the information provided by BG 1 included the following information: Fig. excerpt from the information provided by BG 1 on February 13, 2024 An explanation of what exactly is meant by "personal profile e-commerce" cannot be found in the information. C.9. The following information on automated decision-making, including profiling, was included in the information provided to the BF: 13 - Fig. excerpt from the information provided by BG 1 on February 13, 2024 There is no reference to automated decision-making. Rather, it is explicitly stated that the score values "can support the decision" or be included in the "any decision made by a third party". The following information was provided on the RiskIndicator (DPO note: the indicator on the basis of which the BF's application for the supply of energy was ultimately rejected): 14 - Fig. excerpt from the information provided by BG 1 on March 19, 2024 Further information on the logic involved or the procedures and principles applied in the automated processing of the BF's personal data to obtain a specific result cannot be inferred from the information provided. Evaluation of evidence C.7. to C.9.: The finding results from the documented undisputed file situation. C.10. In response to the BF's request of December 15, 2023, BG 2 did not provide the BF with any information about the logic involved or the procedures and principles applied in the 15 - automated processing of data. In supplementary information dated April 16, it was explained that the application for the supply of energy was rejected due to insufficient creditworthiness and that this was based on the score provided by BG 1. In addition, reference was only made to the information provided by BG 1 on the variables and risk classes of the "RiskIndicator" key figure. Fig. Excerpt from the letter from BG 2 dated April 16, 2025 This information also stated that the decision to refuse was not a decision-making process within the meaning of Art. 22 GDPR. The BF was therefore not informed of the existence of an automated decision within the meaning of Art. Art. 22 was not informed. Evaluation of evidence: The finding results from the undisputed file situation. The entire documentation of all submissions is attached to the file and is used by the DSB as a basis for the decision-making process. D. From a legal point of view, this follows: D.1. For automated decision-making in individual cases, including profiling D.1.1. Preliminary remark The pivotal point and the basis of the present complaints procedure is the question of whether the data processing by the two respondents (BG 1 and BG 2) in the proceedings constitutes exclusively automated decision-making including profiling and thus falls under Art. 22 GDPR. The parameters of the data processing itself (procedure, type of personal data) are not clear due to the 16 - The fact that all parties have provided the same information is undisputed, meaning that only the legal question of subsumption under Art. 22 GDPR remains to be clarified in this regard. The question of the applicability of Art. 22 GDPR is also the basis for the assessment of the alleged violations of Art. 13 para. 2 lit. f, Art. 14 para. 2 lit. g and Art. 15 para. 1 lit. h by the two BGs. D.1.2. On the right under Art. 22 GDPR According to Art. 22 para. 1 GDPR, a data subject has the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning him or her or similarly significantly affects him or her. Recital 71 GDPR cites the automatic rejection of an online credit application or online recruitment procedures that take place without any human intervention as examples of such a legal effect or significant impairment. This is intended to ensure that a data subject is not programs", as technical progress and the possibilities of turned into analyzing an "object of computer-aided even huge amounts of data, as well as artificial intelligence and machine learning, make it possible without too much effort to create various profiles about individuals and make automated decisions that can significantly affect the rights and freedoms of the individual (Jahnel, Kommentar zur Datenschutz Grundverordnung Art. 22 DSGVO, Rz 1 (as of 1.12.2020, rdb.at). According to the guidelines of the Art. 29 Working Party1, the term "right" in the context of Art. 22 para. 1 GDPR does not mean that para. 1 leg. cit. only applies if the data subject actively exercises it. Rather, decision-making based solely on automated processing is generally prohibited, unless one of the exemptions listed in para. 2 leg. cit. applies. With regard to the term "decision", the ECJ stated in its judgment of December 7, 2023 that this is not defined in the GDPR, but that the purposes and objectives pursued by the legal act must also be taken into account when interpreting Union law (ECJ of December 7, 2023, C-634/21, para. 41). The concept of "decision" must therefore be interpreted broadly and can therefore, as the Advocate General also stated in point 38 of his Opinion, encompass several acts that may affect a data subject in many ways. The term is also broad enough to allow the result of the calculation of a person's ability to comply with 1Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, WP251rev.01, p.21 17 - of future payment obligations in the form of a probability value (loc. cit., para. 45 - 46). In summary, the applicability of Art. 22 para. 1 GDPR therefore depends on three cumulative conditions, namely i) the existence of a decision which ii) is based processing, including profiling, and iii) produces legal effects solely on automated concerning a data subject otherwise significantly affects a data subject . Exceptions to the processing prohibition pursuant to Art. 22 para. 2 GDPR The processing prohibition standardized in para. 1 leg. cit. does not apply in absolute terms, however, but is broken if one of the three exceptions in Art. 22 para. 2 GDPR applies. Para. 1 does not apply if or the processing is necessary for the conclusion or performance of a contract between the data subject and the controller-- D.1.2 Applicability of Art. 22 GDPR in the present case To BG 2 the processing is authorized by Union or Member State law (and those provisions contain appropriate measures to safeguard the rights and freedoms of natural persons), or the processing is carried out with the express consent of the data subject. As stated in points C.2. and C.3, the complainant's application for the supply of energy was rejected by BG 2 after it automatically decided, following an automated query of the score value for the "RiskIndicator" from BG 1's "Business Database" data application, that this value was not sufficient and that the BF was therefore not acceptable as a customer. BG 2 therefore clearly made a decision, namely not to accept the BF as a customer. The decision was also based solely on automated processing, which was not only expressly acknowledged by BG 2, but can also only conceivably have taken place in this way due to the chronological sequence (see point C.3.). In addition, the statements in BG 2's letter dated April 16, 2025 also indicate that an application for the supply of energy is automatically rejected if the Risk Indicator value is 400 or higher. This decision also had a significant negative impact on BF, as the fact that the contractual relationship was not established forced it to conclude a contract with a provider that was ultimately less favorable for it, which was time-consuming and costly. The fact that a contract is canceled one minute after it has been concluded can certainly also be regarded as a "legal effect", in particular 18 - as this is a contract for the fulfillment of a basic need (energy in a private household). In the case of BG 2, therefore, all the requirements of Art. 22 para. 1 are met and it therefore applies. BG 1 As described under point A, BG 1 argued, among other things, that it had no decision-making power in the present case, as it had only provided a score value for the "RiskIndicator" indicator and could not influence the final decision of BG 2. In this context, it should first be mentioned that BG 1 nevertheless provided some - albeit only rudimentary - information on the logic involved in its information of February 13, 2024 (see point C.9.) and thus apparently considers the existence of automated decision-making to be at least theoretically possible. In its ruling of December 7, 2023, the ECJ stated the following: "Art 22 para. 1 GDPR [...] must be interpreted as meaning that an "automated decision in an individual case" within the meaning of this provision exists if a probability value based on personal data relating to a person is automatically generated by a credit reference agency to meet future payment obligations with regard to that person's ability , provided that this probability value is decisive as to whether a third party to whom this probability value is transmitted establishes, implements or terminates a contractual relationship with that person" (ECJ of 7 December 2023, C-634/21) All of the aforementioned requirements apply to the present case. Based on the information provided by the parties to the proceedings and the chronological sequence of events described, it is clear that the score value of the "RiskIndicator" automatically calculated and transmitted by BG 1 was a decisive, if not the only, criterion for whether or not a contractual relationship was entered into with the BF. This is supported not least by the fact that the BF was informed only one minute after the provisional conclusion of the contract that it would be canceled again after a credit check had been carried out. Therefore, Art. 22 para. 1 GDPR also applies in the case of BG 1. Interim result As an interim result, it can therefore be stated that the data processing in question fals under Art. 22 para. 1 GDPR in the case of both BG 1 and BG 2. In the following, it must now be examined separately for each BG whether an exception pursuant to para. 2 leg. cit. exists D.1.3. 19 - On the lawfulness of data processing by BG 2 As explained under point D.1.1., there is an exception to the prohibition of automated decision making under Art. 22 para. 2 GDPR if one of three exceptions applies: Necessity of the processing for the conclusion or performance of a contract between the data subject and the controller-- Existence of a legal basis in national or Union law that provides sufficient guarantees for the rights and freedoms of natural persons Explicit consent of the data subject There is no explicit consent from the BF and BG 2 has never invoked such consent. Nor is there a legal basis that meets the requirements of Art. 22 para. 2 lit. b GDPR. It therefore remains to be examined whether the processing can be based on lit. a leg. cit. can be relied upon. As stated, BG 2 operates a company with the purpose of selling energy (electricity and gas). The potential market is therefore very large due to BG 2's nationwide activities and theoretically includes all Austrian households and companies. BG 2 was able to demonstrate that it receives around 6,000 to 10,000 applications for energy supply per month, whereby it is part of the principles of proper business practice to check the creditworthiness of a customer before supplying them. Models such as advance payment or similar are theoretically conceivable, but would probably have a negative impact on the competitiveness of BG 2 if new customers first had to "prove themselves" by paying in advance before being supplied on account therefore no realistic alternative . There is to checking creditworthiness under the given circumstances. With regard to the method of verification by means of an automated query of the RiskIndicator at BG 1 and the decision based on this as to whether an application for delivery is accepted or not, the DSB concludes, after weighing up all the arguments, that the procedure is justified in the case of BG 2. With the high number of applications that BG 2 receives each month, it simply has no realistic possibility of assessing the creditworthiness of the applicants other than automatically. Even if the smallest number of applicants mentioned (6,000 per month) is taken as a basis, this would result in a number of 3,000 person-hours per month, which corresponds to around 18 full-time equivalents (FTEs), assuming a deliberately low time expenditure of 30 minutes per application for the manual check. From the DPO's point of view, such a personnel expenditure for the examination of new applications alone is neither economically feasible nor reasonable. 20 - The processing is therefore necessary for the conclusion of a contract between the controller and a data subject to the extent that it is not otherwise possible to decide whether the contract should be concluded at all or not. The fact that in such cases the decision may in some cases also be to the disadvantage of a data subject is in the nature of things and cannot - contrary to what the BF suggests in its statement of December 5, 2024 - exclude the applicability of the exception under Art. 22 (2) (a). Finally, the guidelines of the Art. 29 Group also expressly mention the possibility of processing for pre-contractual purposes, insofar as this is necessary.2 It should therefore be noted at this point that the automated decision-making by BG 2 in the present constellation was justified in accordance with Art. 22 para. 2 lit. a and therefore lawful. BG 2 also did not violate the BF's rights under Art. 22(3) GDPR (right to obtain the intervention of a natural person, to state his own position and to challenge the decision), as the BF claimed. As can be seen from the file, the BF had the opportunity to present his case and was then offered an alternative (albeit economically less favorable) tariff by BG 2. The BF's argument that these rights were violated because they could only be exercised after a negative decision was made is invalid, as Article 12(3) GDPR explicitly stipulates that the controller must provide the data subject with information on the measures taken at their request in accordance with Articles 15 to 22. This also necessarily means that the rights under Art. 22 para. 3 GDPR can only be asserted after a negative decision has been made for the data subject. Exercising them prior to a decision of any kind would also make no sense, as it is highly unlikely that a data subject would want to have a decision that may have been positive for them reviewed again. Such an objective or purpose cannot be assumed in Art. 22 para. 3 GDPR if interpreted realistically. As explained, BG 2 offered the BF an alternative tariff after the BF's intervention due to the rejection of his application. However, the BF did not accept this offer because he had already found an alternative provider at that time. The fact that BG 2's alternative offer was ultimately not accepted was therefore not within its sphere of influence and cannot be attributed to it. All in all, no violation of Art. 22 GDPR by BG 2 can therefore be established. The complaint was therefore dismissed on this point. 2Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, WP251rev.01, p.25 D.1.4. 21 - On the lawfulness of data processing by the BG 1 The situation is different for data processing by BG 1, which, as explained above, carried out automated decision-making by automatically calculating and transmitting a risk score, which was used by BG 2 as the decisive criterion for rejecting the BF's application. Consent of the BF (Art. 22 para. 2 lit. c GDPR) is also not present here, nor is a legal basis (lit. b. leg. cit). § Section 152 of the Trade Regulation Act (GewO), to which the BG 1 has always referred in its statements, does not contain any special permissions for data processing per se or even automated decision-making. In previous decisions, the data protection authority has already dealt with the requirements regarding the principle of purpose limitation pursuant to Art. 5 para. 1 lit. b GDPR and regarding the lawfulness of data processing in connection with credit checks and, taking into account the case law of the Federal Administrative Court and the ECJ, stated that both criteria must be met in order for the processing to be considered lawful (see the decision of the data protection authority of September 5, 2025, D124.2569/24; 2025-0.271.604). This means that neither data processing in general nor automated decision-making in particular can be based on Section 152 of the Industrial Code. Similarly, in the case of BG 1, there is no contractual relationship with the BF, nor should a contract ever be concluded or initiated between these parties. Thus, BG 1 cannot invoke any exception pursuant to Art. 22 para. 2 GDPR, which means that the prohibition of para. 1 leg. cit. comes into effect. The data processing by BG 1 therefore proves to be unlawful. The complaint was therefore upheld on this point. D.2. Violation of the information obligations pursuant to Art. 13 para. 2 lit. f and Art. 14 para. 2 lit. g GDPR The data protection authority has already dealt with the question of whether the information obligations pursuant to Art. 13 and Art. 14 GDPR can also be asserted as subjective data subject rights and, according to established case law, assumes that a data subject can rely on Art. 13 and Art. 14 GDPR regardless of the application (see the decision of the data protection authority of October 31, 2018, GZ DSB-D123.076/0003-DSB/2018). Art. 13 para. 2 lit. f and Art. 14 para. 2 lit. g GDPR oblige the controller to inform the data subject about the existence of automated decision-making, including profiling, and - at least in these cases - to provide meaningful information about the logic involved. 22 - logic involved, as well as the significance and envisaged consequences of such processing. Regarding BG 1 As stated under point C.5., the privacy policy of BG 1 did not contain any information about the existence of automated decision-making at the time of the alleged infringement. Rather, the relevant passages give the impression that only a calculated score value is transmitted and no decision is made. However, this contradicts the ECJ case law cited under point D.1.2, according to which the automated creation of a probability value with regard to the ability to meet payment obligations already constitutes an automated decision if it significantly depends on whether a third party to whom this probability value is transmitted establishes, implements or terminates a contractual relationship with a data subject (ECJ of December 7, 2023, C-634/21). Although BG 1 agrees that the aforementioned decision of the ECJ was only made after the time of the alleged infringement, this has no relevance for the present case, as the ECJ stated in its landmark case law in the Simmenthal case that Union law and its interpretation must be applied ex tunc and that any conflicting national provisions must remain unapplied (ECJ of March 9, 1978, C-106/77, para. 21). This line of case law has been confirmed in numerous other decisions (e.g. C-213/89). A theoretically possible temporal limitation of the effect of the judgment cannot be inferred from decision C-634/21, which is why its effect ex tunc must be assumed. As stated above, BG 1's privacy policy did not contain any reference to automated decision making in individual cases, which is the sole reason why the BF's right under Art. 14 para. 2 lit. g GDPR was violated. The lack of information about automated decision-making also necessarily implies a lack of the logic involved, even if BG 1 demonstratively mentions some indicators in its privacy policy that can be included in the calculation, although it immediately qualifies that this does not always apply to all indicators. All in all, the complaint against BG 1 was therefore upheld on this point and the infringement was established. For the sake of completeness, reference is made at this point to the case law of the VwGH, according to which the controller's information obligations under Art 13 and Art 14 GDPR exist independently of an 23 - of the data subject and any violation of these rights cannot be remedied retrospectively (VwGH of March 6, 2024, Ro 2021/04/0030, para. 78) Regarding BG 2 As stated under point C.6., the privacy policy of BG 2 also did not contain any information about the existence of automated decision-making or the logic involved in this regard. In light of the above considerations regarding BG 1, the complaint against BG 2 was therefore also upheld on this point and the infringement was established. D.3. Violation of the right to information D.3.1. General Pursuant to Art. 15 GDPR, a data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him or her is being processed. If this is the case, the data subject also has the right to information about this information listed in Art. 15 para. 1 lit. a to h GDPR personal data and about the and, if applicable, additionally about the information pursuant to para. 2 of the provision. Furthermore, in accordance with Art. 15 para. 3 GDPR, the controller must provide a data subject with copies of the personal data that is the subject of the processing. The right of access is important for the data subject in several respects. Firstly, it is intended to ensure that they are aware of whether data concerning them is being processed at all. If this is the case, they should be able to find out what data is involved. This knowledge of the processing forms the basis for the data subject to be able to verify the lawfulness of the processing. The right of access is also necessary so that the data subject can assert their rights to rectification, erasure and blocking, as well as the right to object to processing (see Ehmann/Selmayr [eds.], Datenschutz-Grundverordnung [Vienna 2017], Art. 15, para. 1). In its decision of February 27, 2025, the ECJ took a closer look at the interpretation of Art. 15 para. 1 lit. h GDPR, which obliges a controller to provide a data subject with information about the existence of automated decision-making, including profiling, and to explain the logic involved and the scope of the processing. It expressly stated that the right of access provided for in Art. 15 serves to enable a data subject to verify whether data relating to them is correct and is being processed in a lawful manner. In the context of an automated decision including profiling, this specifically means that the data subject must be able to effectively exercise their rights in accordance with Art. 22 para. 3 GDPR. As the Advocate General also states in point 67 of his Opinion this means that the data subject has 24 - the automated decision a right to an explanation of how making mechanism works and to an explanation of the outcome of the decision. The information must also be provided in a precise, transparent, comprehensible and easily accessible form in accordance with Art. 12 GDPR. Neither the mere transmission of a complex mathematical formula nor the detailed description of each processing step meets these requirements, as this does not constitute a sufficiently comprehensible explanation. On the other hand, it could be considered sufficiently transparent and comprehensible to inform the data subject to what extent a deviation in the personal data taken into account would have led to a different result (see ECJ of February 27, 2025, C-203/22, p.8 f). D.3.2. On the merits Regarding BG 1 As explained under point C.9., BG 1 has provided the BF with information on which variables - if any - are included in the evaluation of the score value for the Risk Indicator. On the one hand, the text stated that the various variables can have a positive, negative or neutral effect, but on the other hand also that it has no influence on the score value if a variable is not filled in. For some variables, such as "payment arrears" or "real property", there are explanations of the direction in which this variable changes, although these explanations are obvious even to laypersons and offer no added insight. It is obvious to everyone that payment arrears have a negative influence on a person's creditworthiness, while higher real property has a positive influence. The information that a variable has a positive, negative or neutral effect on creditworthiness also has no explanatory value, as there is simply no other conceivable effect than the three mentioned. All in all, the information provided does not enable the BF to assess whether the processed data is correct. Consequently, he is also unable to effectively present his point of view, as the superficial nature of the information provided simply does not allow him to present effective counter-arguments. The BF was neither explained the principles of the procedure nor enabled to understand to what extent a deviation in the personal data taken into account would have led to a different outcome. As mentioned deteriorate or remain the same is above , the information that the creditworthiness could improve, to be classified as trivial and without explanatory value. In light of the above, the superficial and non-transparent way of providing information does not meet the requirements of Art. 15 para. 1 lit. h in conjunction with Art. 12 GDPR in the opinion of the DPO. Following the case law of the ECJ, BG 1 will therefore at least have to explain to the BF 25 - have to explain to the BF which specific personal data and which mathematical-statistical principles are used to calculate the scoring value. In addition, BG 1 will have to explain how individual input data influences the result of the calculation (for more details, see point 6). The complaint against BG 1 was therefore upheld on this point. On the information provided by BG 1 regarding the data sources and data recipients Under point C.7. it was stated, among other things, that BG 1 had informed the BF that "KSV 1870" was the source for some data categories (in particular address data). The letter also contained the information that "KSV 1870", together with BG 1 (KSV Information GmbH), belonged to the "KSV 1870 Group". In its statement of 18 November 2024, however, BG 1 stated that it was "not the original source of the data", but rather a "central body" that entered the data "from public registers". These contradictory statements did not enable the complainant to form a picture of the sources from which his data actually originated. A precise and comprehensible form of information is therefore not provided , contrary to the requirements of Art. 12 para. 1 GDPR . With regard to the recipients of the data, it should be noted at this point that the BF was informed that a "personal profile e-commerce" had been transmitted to BG 2, but without informing the BF of what is meant by "personal profile e-commerce". BG 1's statement of November 18, 2024 also stated that all of the BF's data contained on pages 11 to 13 of the information had been transmitted to BG 2. However, this concerns considerably more data than just the score value for the "RiskIndicator" key figure, so that the BF also received contradictory information in this regard, namely on the one hand that only a score value for the RiskIndicator was transmitted and on the other hand that the "E-commerce person profile" and all information on pages 11 to 13 of the information (including name, date of birth, address, debt collection cases, bank details, information from the commercial credit register, etc.) were sent to BG 2. The BF was thus left completely in the dark as to which data was actually transmitted , so that the information did not comply with the requirements of Art. 12 GDPR in conjunction with Art. 15 GDPR on this point either. Therefore, the BF's rights were also violated on this point. 26 - In light of the above, the complaint was therefore upheld on these points and, overall, the BF's rights under Art. 15(1)(c), (g) and (h) were found to have been infringed by BG 1. BG 2 As stated under point C.10, BG 2 did not provide any information on the existence of an automated decision or the logic involved until the conclusion of the proceedings. On the contrary, BG 2 again stated that, in its opinion, the decision taken does not fal under Art. 22 GDPR. Consequently, from the point of view of BG 2, no information is to be provided in accordance with Art. 15 para. 1 lit. h GDPR. However, it was explained in detail under point D.1.2. that the data processing of BG 2 does indeed fal under Art. 22 para. 1 GDPR. However, the existence of an exception and the associated lawfulness of the processing itself does not mean that BG 2 is not subject to the obligation to provide information pursuant to Art. 15 GDPR. By not providing the relevant information pursuant to para. 1 lit. h leg. cit, BG 2 has therefore violated the BF's right to information. The complaint was therefore upheld on this point. D.4. Point 3 of the ruling As stated under point D.1.3., the processing by BG 2 ultimately proved to be lawful, which is why the complaint had to be dismissed on this point. D.5. Regarding point 4 The prohibition is based on Art. 58 para. 2 lit. f GDPR, according to which the supervisory authority has the power to impose a temporary or definitive restriction on processing, including a prohibition. The measure is necessary to ensure that the complainant's personal data is no longer processed unlawfully. D.6. Re point 5 As stated under point D.1.3, BG 2 can invoke the exception under Art. 22 para. 2 processing therefore proved to be lawful, which is why the application to lit. a GDPR. The impose a processing ban on BG 2 had to be rejected. D.7. Regarding points 6 and 7 27 - The performance mandate is based on Art. 58 para. 2 lit. c GDPR. The provision of information must be based on the most recent case law of the ECJ of February 27, 2025 (C-203/22) and must contain at least the details and information set out in point 6. A period of 4 weeks appears appropriate in order to comply with the performance mandate. D.8. Conclusion Overall, the decision was therefore in line with the ruling. R E C O M M E N D A T I O N O F T H E DECISION An appeal against this decision may be lodged in writing with the Federal Administrative Court within four weeks of notification. The appeal must be submitted to the data protection authority and must---- the name of the contested decision (GZ, subject) the name of the authority against which the complaint has been lodged the grounds on which the allegation of illegality is based, the request and contain the information required to assess whether the complaint has been lodged in good time. The data protection authority has the option of either amending its decision within two months by means of a preliminary decision on the complaint or submitting the complaint together with the files of the proceedings to the Federal Administrative Court. The appeal against this decision is subject to a fee. The fixed fee for a corresponding submission including enclosures is EUR 50. The fee is to be paid to the account of the Austrian tax office, stating the purpose of payment. The fee must always be transferred electronically using the "Tax office payment" function. The Austrian Tax Office - Special Jurisdictions Office must be specified or selected as the recipient (IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW). In addition, the tax number/duty account number 10 999/9102, the type of duty "EEE appeal fee", the date of the notice as the period and the amount must be stated. If your bank's e-banking system does not have the "tax office payment" function, the eps procedure in FinanzOnline can be used. An electronic transfer can only be dispensed with if no e-banking system has been used to date (even if the taxpayer has an Internet connection). 28 - taxpayer has an internet connection). In this case, the payment must be made by means of a payment order, whereby the correct allocation must be ensured. Further information is available from the tax office and in the manual "Electronic payment and reporting for the payment of self assessment levies". Proof of payment of the fee must be provided to the data protection authority when submitting the complaint by means of a payment receipt attached to the submission or a printout of the payment order issued. If the fee is not paid or not paid in full, the competent tax office will be notified. A timely and admissible appeal to the Federal Administrative Court has suspensive effect may have been excluded in the ruling of the decision suspensive effect. The or may be excluded by a separate decision. September 25, 2025 The Head of the Data Protection Authority
