01
Factual background & dispute
- A telecommunications operator refused to contract with a consumer based on an automated credit score.
- The credit scoring agency failed to provide the data subject with sufficient information to understand the scoring process.
- The dispute also involved the protection of trade secrets and third-party personal data.
02
Core issues & judicial focus
- What constitutes 'meaningful information about the logic involved' under the GDPR
- Whether the required explanation necessitates disclosing the complete algorithm or source code
- How to reconcile trade secret protections with a data subject's right to information and contestation
03
Judicial finding & holding
- The explanation must convey the procedures and principles underlying the automated decision in a concise, intelligible format.
- The explanation must enable the data subject to understand how specific personal data affected the decision and to contest the outcome effectively.
- Supervisory authorities or courts must balance trade secret interests against individual rights within appropriate protective procedures.
04
Practical risk implications
01Automated decision-making notices must be tailored to the individual and the specific outcome.
02Organizations should prepare accessible explanations detailing key variables, thresholds, counterfactual outcomes, and appeal channels.
03Trade secrets can be safeguarded through restricted disclosure mechanisms and regulatory in camera reviews.