Court of Justice of the EU (Austrian referral, C-203/22) v. Dun & Bradstreet Austria GmbH
In C-203/22 the CJEU ruled that a person subject to automated credit-scoring is entitled under Article 15(1)(h) GDPR to a meaningful explanation of the procedure and principles actually applied; a bare formula/algorithm is insufficient and trade secrets must be disclosed to the authority or court.
Key takeaway — how to prevent this
Don't overstate AI capabilities to investors or customers. 'AI-washing' — claiming AI you don't have, or that doesn't work as described — triggers securities and consumer-protection enforcement; disclosures must match reality.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Court of Justice
- Parties
- — v. Dun & Bradstreet Austria
- Decision date
- February 27, 2025
- Remedy
- The Court of Justice ruled that data controllers must explain the procedure and principles of automated decisions to data subjects and that national trade secret protections cannot automatically restrict access rights.
- Appeal
- Appeal status not stated
Key holdings
Data controllers must explain the procedure and principles used in automated decision-making so data subjects understand how their personal data was used.
“the controller must describe the procedure and principles actually applied in such a way that the data subject can understand which of his or her personal data have been used”
Simply communicating an algorithm does not constitute a sufficiently clear explanation of an automated decision.
“the mere communication of an algorithm does not constitute a sufficiently concise and intelligible explanation.”
Data protection rules preclude national provisions from automatically denying access rights to protect trade secrets.
“the GDPR precludes the application of a national provision which excludes, as a rule, the right of access in question where it would compromise a trade secret”
In plain English
In Austria, a mobile phone operator rejected a customer's application for a contract involving a monthly payment of €10 because of an insufficient credit standing score. This score was generated through automated decision-making by Dun & Bradstreet Austria, a company specializing in credit assessments. In a prior proceeding, an Austrian court decided that Dun & Bradstreet violated data protection rules by failing to give meaningful information about the logic behind the automated assessment, or at least failing to adequately explain why it could not provide that information. To enforce that ruling, the Austrian court asked the Court of Justice for guidance on interpreting data protection rules and trade secret protections. The Court of Justice held that data controllers must explain the principles and procedures used in automated decision-making so individuals can understand how their personal data was processed. Providing an algorithm alone is not sufficient to meet transparency requirements. Furthermore, if a controller claims that providing information would expose trade secrets or protected data of third parties, the controller must submit that information to a court or supervisory authority. That body must then balance the competing rights and interests. The Court of Justice clarified that general national rules automatically blocking access to protect trade secrets are incompatible with data protection laws.
Inclusion does not imply wrongdoing or liability. A filed lawsuit is an allegation, not a court finding. Status reflects the latest information we have — always check the official source for current status.