01
Factual background & dispute
- A telecommunications operator refused to contract with a consumer based on an automated credit score.
- The credit scoring agency failed to provide the data subject with sufficient information to understand the scoring process.
- The dispute also involved the protection of trade secrets and third-party personal data.
02
Core issues & judicial focus
- What constitutes 'meaningful information about the logic involved' under the GDPR
- Whether the required explanation necessitates disclosing the complete algorithm or source code
- How to reconcile trade secret protections with a data subject's right to information and contestation
03
Judicial finding & holding
- The account must explain the actual procedures and principles so the person can challenge the decision. A complex formula or exhaustive steps alone may be insufficient.
- Showing the effect of data changes is one possible method, not a mandatory format in every case or a duty to disclose the entire algorithm.
- Material involving trade secrets or third-party personal data must be supplied to the competent authority or court for case-specific balancing, rather than supporting a blanket refusal.
- The EU interpretation was reviewed; the latest final domestic Austrian outcome was not.
04
Practical risk implications
01Automated decision-making notices must be tailored to the individual and the specific outcome.
02Organizations should prepare accessible explanations detailing key variables, thresholds, counterfactual outcomes, and appeal channels.
03Trade secrets can be safeguarded through restricted disclosure mechanisms and regulatory in camera reviews.