DSB (Austria) - D124.2695/24 2025-0.328.963
From GDPRhub
| DSB - D124.2695/24 2025-0.328.963 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 12 GDPR Article 15(1)(c) GDPR Article 15(1)(g) GDPR Article 15(1)(h) GDPR Article 22(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 28.11.2024 |
| Decided: | 14.10.2025 |
| Published: | |
| Fine: | n/a |
| Parties: | CRIF |
| National Case Number/Name: | D124.2695/24 2025-0.328.963 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | German |
| Original Source: | DSB (Austria) (in DE) |
| Initial Contributor: | XZ |
The DPA held that a credit information agency failed to provide a data subject access to the logic involved in its automated credit scoring and to sources and recipients of the data subject’s personal data.
English Summary
Facts
The data subject submitted a request for information pursuant to Article 15 GDPR to CRIF, a credit information agency that collects and processes personal data to assess creditworthiness.
The information provided to the data subject by CRIF contained general categories of personal data and score values, but no detailed explanation of the calculation logic.
The data subject lodged a complaint with the Austrian DPA (DSB), arguing that the information provided by CRIF was incomplete. The basis on which the "verification score" and the values mentioned under "personal hits" were based was not disclosed. Also copies of the data records that had been passed on by or to third parties, were not provided. The data subject further stated that the scores based on place of residence did not reflect his actual creditworthiness and were therefore unlawful.
CRIF stated that the verification score serves to confirm identities and is based on several parameters. It also argued that details of the calculation would only have to be disclosed to the extent that no business secrets would be affected.
Holding
The DSB upheld the complaint and stated that CRIF violated the data subject’s right to information pursuant to Article 15(1)(c), (g), and (h) GDPR and transparency obligations under Article 12(1) GDPR. CRIF failed to provide any meaningful information about the logic involved or the scope and intended effects of automated data processing (including profiling) and copies of the processed personal data. Also CRIF did not disclose a sufficient specification of the data transmitted to recipients, or any details regarding the transfer of personal data to a third country.
According to CJEU case law, under Article 15(1)(h) GDPR, a controller is obliged to inform the data subject about the existence of automated decision-making, including profiling, and to explain the logic involved and the scope of processing, in order to enable the data subject to effectively exercise his rights under Article 22(3) GDPR. The information must also be provided in a precise, transparent, comprehensible and easily accessible form in accordance with Article 12 GDPR. It it could be considered sufficiently transparent and comprehensible to inform the data subject to what extent a deviation in the personal data taken into account would have led to a different result. The information CRIF provided did not allow the data subject to assess the accuracy of the processed data or to effectively present his point of view. The principles underlying the procedure were not explained to the data subject and it was in a position to understand to what extent a variation in the personal data used could have led to a different outcome.
Moreover, the data subject did not receive copies of all processed personal data, violating Article 15(3) GDPR and a mere tabular listing of data fields does not satisfy this right. According to the CJEU case law, the right of access includes the right to receive a complete copy of the data, where necessary to verify the lawfulness of processing. Although categories of data, recipients and general explanations of the score calculation were provided, no specific copies of the processed data or detailed information on the calculation logic were transmitted.
CRIF was therefore ordered to provide the data subject with complete information within a period of four weeks, explaining which specific personal data is used to calculate the scoring value, according to which mathematical-statistical principles and how individual input data influences the result of the calculation.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Ref. No.: D124.2695/24
2025-0.328.963
Data Protection Complaint (Right to Information)
CRIF GmbH
Clerk:
DECISION
RULING
The Data Protection Authority decides on the data protection complaint filed by
(complainant) on November 28, 2024, against CRIF GmbH (respondent) for
violation of the right to information under Art. 15 GDPR as follows:
1. The complaint is upheld and it is determined as follows:
The respondent has violated the complainant's right to information
under Art. 15 (1) (c), (g) and (h) GDPR by failing to provide him, upon his request of
September 15, 2024, with transparent, understandable, and complete information about the
origin of his data, the recipients of his data, the existence of automated decision-making, and meaningful and understandable information about the logic involved, as well as the scope and intended effects of the processing.
2. The respondent is ordered to provide the complainant with complete, transparent, and understandable information within the meaning of Article 15 (1) (c), (g) and (h) GDPR and Article 15 (3) GDPR within four weeks, failing which execution will be required. The information must, in particular, meet the following requirements:
- - 2 – - - -
It must clearly disclose which specific personal data is used
and which mathematical and statistical principles are used to calculate the scoring value.
It must make the significance of the individual input data for calculating the result
transparent and explain how this influences the result.
It must describe the possible impact of the scoring value on the decision regarding the
conclusion, performance, or termination of a contractual relationship for the data subject.
The information must be provided in a manner that is understandable and easily accessible to an average data subject.
3. The request to impose an effective penalty is rejected.
Legal basis: Article 12 (1), Article 15, Article 51 (1), Article 57 (1) (f), Article 58, and Article 77 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), OJ L 119, 4 May 2016, p. 1; Sections 18 (1) and 24 (1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended.
GROUNDS
A. Arguments of the parties and course of proceedings
A.1 In a submission initiating the proceedings dated November 28, 2024 (received by the DPA: December 3, 2024), the complainant filed a complaint with the Data Protection Authority, arguing that the information provided by the respondent was incomplete. In particular, the basis on which the "Verification Score" and the values listed under "Personal Matches" were based was not disclosed, making it impossible to correct the data. Furthermore, the complainant repeatedly refused to provide copies of the data records that had been passed on by or to third parties. The complainant also suggested that the practice of assessing solvency based on age or place of residence be ex officio reviewed and referred, in addition, to the Advocate General's Opinion in Case C-203/22.
A.2 In its statement of January 27, 2025, the respondent stated that the Verification Score serves to confirm identities and is based on parameters such as length of time known, type and number of sources, and payment experience. Details of the calculation only need to be disclosed to the extent that they do not affect trade secrets. There is no obligation to provide copies of data, as all of the complainant's personal data is already contained in the self-disclosure. The use of age and place of residence to calculate the score is covered by law and justified by legitimate interests pursuant to Art. 6 (1) (f) GDPR.
- 3 –
A.3 In a letter dated February 5, 2025, the complainant submitted another statement. He requested that his original requests be granted in full and stated that the information provided by the respondent remained incomplete because he had not been provided with copies of the data transmitted by or to third parties and the calculation of the transmitted values had not been disclosed. He referred to the ECJ ruling C-487/21 of May 4, 2023, according to which Article 15 (3) GDPR grants the right to a complete, intelligible reproduction of all personal data processed, insofar as this is necessary for the exercise of the data subject's rights.
A.4 After being granted an extension, the respondent summarized the following in its statement
of April 4, 2025: The respondent argued that the ECJ
decisions C-203/22 ("D&B decision") and C-634/22 ("SCHUFA decision") were not applicable in the present case, since the submitted score values for the customers concerned were not decisive for their decisions. The explanations regarding the score calculation in the self-disclosure were sufficiently precise and clear within the meaning of Art. 12 (1) GDPR, so that the
complainant was able to fully exercise his rights. With regard to copies of
data records, it stated that disclosure was not mandatory, since all relevant personal data was already contained in the last disclosure dated September 26, 2024, and the exercise of the rights under the GDPR was therefore possible.
A.5 In a submission dated April 27, 2025, the complainant argued that the information provided by the respondent remained incomplete because no comprehensible information had been provided regarding the logic, scope, and effects of the automated data processing, including the calculation of the "values" and "scores." He referred to the ECJ judgment
C-487/21 and Article 15(1)(h) GDPR, which requires such information to be disclosed in a precise, transparent, and understandable form. He further argued that the scores based on place of residence did not reflect his actual creditworthiness and were therefore unlawful.
B. Subject Matter of the Complaint
The subject matter of the complaint is the question of whether the respondent violated the complainant's right to information under Art. 15 GDPR by failing to provide him with complete copies of the processed data, in particular the data transmitted by or to third parties, and by failing to provide him with a comprehensible explanation of how the "Verification Score" (probability value) is calculated.
C. Findings of Fact
C.1 The respondent is a registered limited liability company with its registered office in
Vienna and operates as a credit agency pursuant to Section 152 of the German Trade Regulation Act (GewO).
- 4 -
It collects and processes personal data for credit assessment purposes and provides its contractual partners with scoring values (e.g., "Verification Score," "Risk Indicator").
Evaluation of evidence: The findings arise from an official query of the Commercial Register
and the Austrian Business Information System, all last queried by the Data Protection Authority on
September 26, 2025.
C.2 The complainant submitted a request for information pursuant to Art. 15 GDPR on September 15, 2024, which was answered by the respondent on September 26, 2024.
The information contained general categories of personal data (e.g., name, address,
date of birth) and score values, but no detailed explanation of the calculation logic.
(Formatting not reproduced 1:1):
- 5 –
- 6 –
In addition, the respondent's information shows the following score values for the complainant (formatting not reproduced 1:1):
- 7 –
Evaluation of evidence: The findings arise from the complainant's submission of
November 28, 2024, and the respondent's enclosed response to the information, in which, among other things, this data set was included in the response. The finding of the
automated calculation arises from the respondent's information to the
complainant. While it is stated there that two of the variables represent the personal assessment of a human, it is qualified by stating that omitting variables has no influence on the score (in other words: the score can also be calculated completely automatically
without human intervention). In the present case, the DPO concludes, based on the evidence, that the risk indicator is calculated entirely automatically, and that human intervention is limited to a non-mandatory and non-decision-making option. The calculation or decision is therefore not subject to any genuine oversight, as required, for example, in the guidelines of the Article 29 Data Protection Working Party (see Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, WP251rev.01, p. 22).
D. From a legal perspective, this leads to the following:
D.1 Regarding the violation of the right to information (point 1)
According to Article 15 (1) GDPR, a data subject has the right to receive information from the controller about personal data concerning him or her, as well as about the information referred to in letters a–h.
- 8 –
According to Article 15 (3) GDPR, a data subject must also be provided with a copy of the personal data processed. In its judgment of May 4, 2023, C-487/21, the ECJ clarified that
Article 15(3) GDPR grants a right to the actual reproduction of personal data
to the extent that this is necessary to exercise the rights of the data subject.
In its decision of February 27, 2025, the ECJ examined the interpretation of Article 15(1)(f) GDPR in more detail.h GDPR, which requires a controller to provide a data subject with information about the existence of automated decision-making, including profiling, and to explain the logic involved and the scope of the processing. In doing so, it explicitly stated that the right of information provided for in Article 15 serves to enable a data subject to verify whether data concerning them is accurate and lawfully processed. In the context of an automated decision, including profiling, this means that the data subject must be enabled to effectively exercise their rights under Article 22(3) GDPR. As the Advocate General also stated in point 67 of his Opinion, this means that the data subject has a right to an explanation of how the automated decision-making mechanism works, as well as an explanation of the outcome of the decision. Furthermore, according to Article 12 GDPR, the information must be provided in a concise, transparent, intelligible, and easily accessible form. Neither the mere transmission of a complex mathematical formula nor the detailed description of each processing step meets these requirements, as this does not constitute a sufficiently comprehensible explanation. On the other hand, it could be considered sufficiently transparent and comprehensible to inform the data subject of the extent to which a deviation from the personal data taken into account would have led to a different result (see ECJ of February 27, 2025, C-203/22, p. 8 et seq.).
It could not be established that the complainant received complete information that complied with the requirements of the GDPR in the context of his request for information pursuant to Art. 15 GDPR. In particular, the complainant was not provided with any meaningful information about the logic involved, the scope, and the intended effects of the automated data processing (including profiling).
Likewise, no copies of the processed personal data were sent to him,
in particular those received from or forwarded to third parties. Furthermore, the data transmitted to the recipients named in the information was not sufficiently specified.
Finally, the information did not contain any information on any transfer of personal data to a third country or to international organizations.
The self-disclosure reveals that although categories of data, recipients, and general explanations of the score calculation were listed, no specific copies of the processed data were transmitted. Likewise, detailed information on the calculation logic
- 9 –
of the score values is missing. Since the respondent itself states in its statements that certain information (such as the weighting of the score characteristics or the transmission of exact data sets) is not provided, it can be assumed that the complainant did not receive complete information in accordance with Art. 15 GDPR.
The mere statement of which data types "could in principle be included" does not constitute meaningful information about the logic involved and the scope within the meaning of Art. 15 (1) (h) GDPR.
The respondent has thus violated its obligations under Art. 12 (1) GDPR (transparency, comprehensibility) as well as Art. 15 (1) (c), (g), and (h) GDPR.
The precise and comprehensible explanation required by the ECJ regarding the extent to which individual input data influences the result is completely missing.
All in all, the information provided does not enable the complainant to assess whether the processed data is correct. Consequently, the complainant cannot effectively present his or her point of view, since the superficial nature of the information simply makes it impossible for him or her to present effective counterarguments. The complainant was neither informed of the principles of the procedure nor given the opportunity to understand the extent to which a deviation in the personal data taken into account would have led to a different result.
In light of the above, the DSB considers that the superficial and lacking transparency in the way the information was provided does not meet the requirements of Article 15 (1) (h) in conjunction with Article 12 of the GDPR. Therefore, in accordance with the case law of the ECJ, the respondent will have to at least explain to the Federal Administrative Court the specific personal data and the mathematical and statistical principles used to calculate the scoring value. Furthermore, the respondent will have to explain how individual input data influences the result of the calculation (see point 2 of the ruling for more details).
D.2 On the release of copies
According to the case law of the ECJ, the right to information also includes the right to receive
a complete copy of all personal data processed, insofar as this is necessary
to verify the lawfulness of the processing. The respondent did not provide the
complainant with such copies. A mere tabular list of
data fields does not satisfy this right.
The complaint was therefore upheld in its entirety.
D. 3 On the performance contract (point 2 of the ruling) - 10 –
The performance contract is based on Article 58 (2) (c) GDPR. The provision of information must be
based on the most recent case law of the ECJ of February 27, 2025 (C-203/22) and
must contain at least the details and information set out in point 6 of the ruling.
A period of four weeks appears appropriate to comply with the performance contract.
D.4 On the application for the imposition of an effective penalty (point 3 of the ruling)
According to the case law of both the ECJ (see the judgment of September 26, 2024, C-768/21) and the VwGH (see, for example, the decision of July 26, 2019, File No. DSB-D123.921/0005-DSB/2019 with further references), there is no subjective right to claim specific remedial measures under Art. 58 (2) GDPR or to the imposition of an administrative penalty.
In the present case, the imposition of an administrative penalty does not appear necessary to compel the respondent to provide legally compliant information and thus ensure compliance with the GDPR.
INFORMATION ON LEGAL REMEDIES
A written appeal against this decision may be filed
with the Federal Administrative Court within four weeks of service. The appeal must be submitted to the Data Protection Authority
and must contain - - -
the name of the contested decision (reference number, subject),
the name of the authority being challenged,
the reasons on which the allegation of illegality is based, - the request, and -
the information necessary to assess whether the appeal was filed in a timely manner.
The Data Protection Authority has the option, within two months, to either amend its decision by
issuing a preliminary decision on the appeal or to submit the appeal and the files of the
proceedings to the Federal Administrative Court.
An appeal against this decision is subject to a fee. The fixed fee for a
corresponding submission, including attachments, is 50 euros. The fee must be paid into the account of the Austrian Tax Office, stating the
intended purpose.
The fee must be paid to the Austrian Tax Office account. - 11 –
The fee must generally be transferred electronically using the "Tax Office Payment" function. The Austrian Tax Office - Special Competences Department must be specified as the
recipient, or
the tax number/tax account number must be selected.
Furthermore, the tax type "EEE - Appeal Fee," the
date of the notice as the period, and the amount must be specified.
If your bank's e-banking system does not have the "Tax Office Payment" function,
the eps procedure in FinanzOnline can be used. Electronic transfer can only be dispensed with if no e-banking system has been used previously (even if the
taxpayer has an internet connection). In this case, the payment must be made by
payment order, ensuring that the correct allocation is made. Further information
is available from the tax office and in the manual "Electronic Payment and Reporting for the Payment of Self-Assessed Taxes."
``` Payment of the fee must be proven when submitting a complaint to the Data Protection Authority by means of a payment receipt attached to the complaint or a printout of the payment order issued. If the fee is not paid
or not paid in full, a report will be sent to the responsible tax office.
A timely and admissible complaint to the Federal Administrative Court has
suspensive effect. The suspensive effect may have been excluded in the decision or may be excluded by a separate decision.
October 14, 2025
The Head of the Data Protection Authority:
