62022CJ0203_RES
Case C‑203/22
CK
v
Magistrat der Stadt Wien
(Request for a preliminary ruling from the Verwaltungsgericht Wien)
Judgment of the Court (First Chamber) of 27 February 2025
(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Automated decision-making, including profiling – Right of access to meaningful information about the logic involved in profiling – Scope
(European Parliament and Council Regulation 2016/679, Arts 12(1), 15(1)(h) and (3), and 22(1) and (3))
(see paragraphs 40-43, 47, 48, 50, 58, 59, 61, 62, 66, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Data subject’s right of access to his or her data undergoing processing – Automated decision-making, including profiling – Right of access to meaningful information about the logic involved in profiling – Respect for the rights and freedoms of others – Right to protection of personal data of third parties and of trade secrets – Balancing of rights and interests at issue by the competent supervisory authority or court
(European Parliament and Council Regulation 2016/679, recital 63 and Art. 15(1)(h); European Parliament and Council Directive 2016/943, Art. 2(1))
(see paragraphs 72-76, operative part 2)
Résumé
Hearing a matter referred by the Verwaltungsgericht Wien (Administrative Court, Vienna, Austria) for a preliminary ruling, the Court of Justice develops its recent case-law on the rights of data subjects concerned by profiling for the purposes of assessing their creditworthiness. (
1
) First, it defines the scope of the data subject’s right of access to information relating to the processing of his or her data. Second, it rules on the balancing of that right with the right to protection of third parties’ data or trade secrets.
CK was refused, by a mobile telephone operator, the conclusion or extension of a mobile telephone contract. That refusal was based on an automated assessment of her credit standing carried out by D & B, an undertaking specialising in the provision of such assessments.
By its decision, the Austrian data protection authority ordered D & B to provide CK with meaningful information about the logic involved in the automated decision-making based on CK’s personal data. The action, brought by D & B against that decision, was dismissed by decision of 23 October 2019 of the Bundesverwaltungsgericht (Federal Administrative Court, Austria). The Magistrat der Stadt Wien (City Council of Vienna, Austria) rejected CK’s application for enforcement of that judicial decision.
Hearing CK’s action against the decision of the City Council of Vienna, the referring court asks the Court to clarify the scope of the information which must be provided to the data subject in order for his or her right of access provided for by the General Data Protection Regulation (
2
) to be guaranteed in full. It also asks the Court to clarify whether and to what extent the exception based on the existence of a trade secret is capable of restricting that right.
Findings of the Court
In the first place, by clarifying the right of the data subject concerned by an automated decision, including profiling, to have access to ‘meaningful information about the logic involved’ within the meaning of Article 15(1)(h) of the GDPR, the Court, on the basis of the various language versions of that provision, takes the view that its wording covers all relevant information concerning the procedure and principles relating to the use, by automated means, of personal data with a view to obtaining a specific result.
The Court then notes that the contextual interpretation of that provision of the GDPR supports the literal interpretation thereof and that, moreover, the requirement of transparency which applies to all data and information, including those relating to automated decision-making, (
3
) requires that that information be provided in a concise, transparent, intelligible and easily accessible form.
In addition, the Court points out that it is apparent from the examination of the purposes of the GDPR and, in particular, those of Article 15(1)(h) thereof that the right to obtain ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of that provision, must be understood as a right to an explanation of the procedure and principles actually applied in order to use, by automated means, the personal data of the data subject with a view to obtaining a specific result, such as a credit profile. In order to enable the data subject to exercise his or her rights under the GDPR (
4
) effectively, that explanation must be provided by means of relevant information and in a concise, transparent, intelligible and easily accessible form. Those requirements cannot be satisfied either by the mere communication of a complex mathematical formula, such as an algorithm, or by the detailed description of all the steps in automated decision-making, since none of those would constitute a sufficiently concise and intelligible explanation.
The Court concludes that the ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of Article 15(1)(h) of the GDPR, must describe the procedure and principles actually applied in such a way that the data subject can understand which of his or her personal data have been used in what way in the automated decision-making, with the complexity of the operations to be carried out in the context of automated decision-making not being capable of relieving the controller of the duty to provide an explanation.
It states, specifically concerning profiling such as that in the present case, that the referring court may find, inter alia, that it is sufficiently transparent and intelligible to inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result.
In the second place, as regards the balancing of the right of access guaranteed by the GDPR with the right to protection of third parties’ data or trade secrets, (
5
) the Court begins by recalling its case-law according to which a national court may take the view that the personal data of the parties or of third parties must be disclosed to it in order to be able to balance, in full knowledge of the facts and in accordance with the principle of proportionality, the interests involved. That assessment may, depending on the case, lead it to authorise the full or partial disclosure to the opposing party of the personal data thus communicated to it, if it finds that such disclosure does not go beyond what is necessary for the purpose of guaranteeing the effective enjoyment of the rights which individuals derive from Article 47 of the Charter of Fundamental Rights of the European Union. (
6
)
Next, it states that that case-law can be fully transposed to the situation in which the information to be provided to the data subject under the right of access guaranteed by Article 15(1)(h) of the GDPR is likely to result in an infringement of the rights and freedoms of others, in particular in so far as it contains personal data of third parties protected by that regulation or trade secrets. In that case too, that information must be disclosed to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access to personal data concerning him or her.
The Court notes that, having regard to the need to make that determination on a case-by-case basis, Article 15(1)(h) of the GDPR precludes inter alia the application of a national provision which excludes, as a rule, the data subject’s right of access where such access would compromise a business or trade secret of the controller or of a third party. In that regard, the Court recalls that a Member State cannot definitively prescribe the result of a case-by-case balancing of the rights and interests at issue imposed by EU law. (
7
)
In conclusion, the Court held that Article 15(1)(h) of the GDPR must be interpreted as meaning that, where the controller takes the view that the information to be provided to the data subject in accordance with that provision contains data of third parties protected by that regulation or trade secrets, that controller is required to provide the allegedly protected information to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access provided for in Article 15 of the GDPR.
(
1
)	Judgment of 7 December 2023, SCHUFA Holding and Others (Scoring) (C‑634/21, EU:C:2023:957).
(
2
)	Article 15(1)(h) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
(
3
)	Referred to in Article 12(1) of the GDPR.
(
4
)	In particular, Article 22(3) of the GDPR.
(
5
)	Within the meaning of point 1 of Article 2 of Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ 2016 L 157, p. 1).
(
6
)	Judgment of 2 March 2023, Norra Stockholm Bygg (C‑268/21, EU:C:2023:145, paragraph 58).
(
7
)	See, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others (Scoring) (C‑634/21, EU:C:2023:957, paragraph 70 and the case-law cited).