Court of Justice of the European Union — Magistrat der Stadt Wien (Reference for a preliminary ruling – Protect

Decided by

Court of Justice of the European Union

Parties

CK v. Magistrat der Stadt Wien

Decision date

February 27, 2025

Remedy

The Court of Justice of the European Union issued a preliminary ruling establishing legal standards for data subjects' rights to access meaningful explanations of automated decision-making and profiling logic under the General Data Protection Regulation.

Appeal

Appeal status not stated

Key holdings

1. Data subjects subject to automated decision-making or profiling are entitled to an explanation of the procedure and principles applied in a concise, transparent, intelligible, and easily accessible form.

   “explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied” — paragraph 66

2. Data controllers cannot automatically refuse access by claiming trade secrets or third-party rights, but must submit the material to a court or supervisory authority to balance the competing interests.

   “that controller is required to provide the allegedly protected information to the competent supervisory authority or court, which must balance the rights and interests at issue” — paragraph 76

3. Providing meaningful information about automated profiling logic does not require disclosing full software algorithms or overly complex mathematical explanations.

   “not necessarily a complex explanation of the algorithms used or disclosure of the full algorithm” — paragraph 60

In plain English

A natural person, CK, was denied a mobile telephone contract after credit assessment agency Dun & Bradstreet Austria GmbH performed automated credit scoring resulting in an unfavorable evaluation. Following an administrative decision requiring Dun & Bradstreet to provide meaningful information about the logic involved in the credit assessment, the company refused to disclose further details, arguing that its algorithm constituted a protected trade secret. In enforcement proceedings, the Administrative Court in Vienna, Austria, referred questions to the Court of Justice of the European Union concerning the extent of information required under Article 15(1)(h) of the General Data Protection Regulation and how to balance access rights with trade secrecy. The Court of Justice of the European Union ruled that the right to meaningful information about automated processing logic grants data subjects an explanation of the principles and procedures actually applied in a concise, transparent, intelligible, and easily accessible form. The Court clarified that this obligation does not require releasing full proprietary algorithms or complex code descriptions. Furthermore, the Court held that a data controller cannot unilaterally withhold information by claiming trade secrecy or third-party data protection under Directive 2016/943. Instead, the controller must present the contested information to the competent supervisory authority or court, which must independently assess and balance the competing rights to determine the proper scope of disclosure.