News

10.10.2024

Clarifying Automated Decision-Making: Insights from CJEU Advocate General's Opinion

In Case C 203/22, the Advocate General of the Court of Justice of the European Union (CJEU) addressed an important issue regarding how individuals are informed about automated decision-making under the GDPR.

Background

A cell phone operator refused to sign a contract with a person, claiming he did not have enough creditworthiness. To evaluate this, the operator used data from Dun & Bradstreet Austria GmbH. The individual requested information about the automated decision-making process under Article 15(1)(h) of the GDPR. Upon the complaint, the Austrian Data Protection Authority (DPA) requested the operator explain its assessment methods.

The operator appealed the DPA’s request to the Federal Administrative Court. The court ruled that the operator did not provide sufficient information regarding its decision to deny the contract. This was deemed a violation of the GDPR, and the DPA's decision was partially upheld. In the enforcement proceedings, the City Council of Vienna, serving as the enforcing authority, dismissed the case, arguing that Dun & Bradstreet had already supplied the data subject with the necessary information. In addition, the Council submitted questions to the CJEU regarding the scope of the obligation to provide meaningful information under the GDPR and how to strike a balance with the protection of trade secrets.

Advocate General's Opinion

In a recent opinion on this case, Advocate General De La Tour emphasized the importance of providing clear information about automated decision-making. AG stated that individuals have the right to understand how these decisions are made, which is essential for protecting their rights under the GDPR. AG also argued that companies must be transparent and share details about the criteria used in their decision-making processes. To ensure clarity in automatic decision-making, it is important to provide detailed information about the context and logic behind the process. However, "meaningful information" does not require revealing the complex algorithm itself. Instead, a straightforward description of the methods used, the criteria considered, and their importance is more beneficial for individuals. This description should include the method employed, the criteria considered, and their respective weighting.

Conclusion

The structure of algorithms, often considered trade secrets, should be carefully managed when disclosing information about decisions affecting data subjects. The Advocate General highlighted the need to balance the rights of individuals with GDPR requirements, ensuring that disclosed information aligns with proportionality and trade secret protections. A case-by-case approach is essential to safeguarding the rights of data subjects effectively. It would be also appropriate to follow the CJEU's decision on this opinion and to examine whether the Court will agree with the AG's findings.

Selenay Cesur

Hividar Kılıç