complainant (controller) – Court Ruling (Austria, 2025)

On 7 April 2021, the data subject requested access to their data under Article 15 GDPR. The controller replied on 12 April 2021 and provided further information on 27 May 2021 after the data subject made a further enquiry. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13 July 2021. They argued that the data provided and its sources were incomplete. On 03 January 2022, the DPA partly upheld the complaint and ruled that the controller violated the right of access by not providing information pursuant to Article 15(1)(h) GDPR, as the calculation of the creditworthiness constitutes profiling under Article 4(4) GDPR. On 09 February 2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. The proceedings were stayed until the CJEU's preliminary ruling in [https://infocuria.curia.europa.eu/tabs/document/C/2022/C-0203-22-00000000RP-01-P-01/ARRET/295841-EN-1-html 'Dun & Bradstreet Austria' (C‑203/22)]. By letter of 15 May 2025, the court resumed the case. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. Hence, the following data is used to calculate the credit score: Name, age, gender, address, macroeconomic statistical parameters, payment history. The calculation itself is performed automatically using an algorithm and the same formula unless the controller's customers order a different score model. First the court ruled that the controller had an obligation to provide information under Article 15(1)(h) GDPR, as all three cumulative requirements pursuant to Article 22 GDPR were stated to be met: A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of Article 4(4) GDPR ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) . Second, the court held that the controller failed to provide meaningful information under Article 15(1)(h) GDPR to sufficiently explain why the data subject had been assigned a particular credit score, including the logic and weighting of the data categories in question, and its corresponding effects on the data subject. Third, the court ruled that the controller asserted the presence of trade secrets in very general terms without providing the allegedly protected information to the DPA or the court. Fourth, the court held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to [https://ris.bka.gv.at/eli/bgbl/1930/1/A133/NOR40201324?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=B-VG&Gesetzesnummer=&VonArtikel=133&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=4c0c3096-fcc5-4494-8001-860e8840f341 Article 133(4) B-VG], as no (further) indications of legal questions of fundamental importance were raised. The court based their ruling, among others, in accordance with the following CJEU's judgments: In [https://juris.curia.europa.eu/juris/document/document.jsf?text=&docid=280426&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1505002 'SCHUFA' (C‑634/21)], the court ruled that the concept of 'automated individual decision-making' under Article 22(1) GDPR encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In [https://infocuria.curia.europa.eu/tabs/document/C/2022/C-0203-22-00000000RP-01-P-01/ARRET/295841-EN-1-html 'Dun & Bradstreet Austria' (C-203/22)], the court stated that the wording of Article 15(1)(h) GDPR must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure.