Dr. Markus A*** (Complainant) – Complaint Upheld (Austria, 2020)

The respondent had calculated marketing scores called „Dominanten Geo Milieus“ regarding the complainant. These scores consisted of alleged likelihoods (expressed in a percentage number) that the complainant would belong to certain demographic groups, such as "conservatives", "traditionalists", "hedonists" or "digital individualists". In May 2019, the complainant sent an access request under Article 15 GDPR to the respondent, requesting i.a. information under Article 15(1)(h) GDPR on how the marketing scores have been calculated. In June 2019, the respondent replied, stating that the requested information will not be provided because it qualifies as a trade secret within the meaning of § 4(6) Austrian Data Protection Act (Datenschutzgesetz - DSG). (Note: §4(6) DSG is considered as national law adopted under Article 23(1)(i) GDPR.) Consequently, the complainant filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). * Is the respondent under the obligation to provide information under Article 15(1)(h) GDPR ("meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject") to the respondent regarding the marketing scores „Dominanten Geo Milieus“? * If so, could the respondent invoke a trade secret within the meaning of § 4(6) DSG and rightfully refuse to provide said information? The DSB initially held, that the marketing scores at hand constitute personal data under Article 4(1) GDPR as they have been assigned to individual natural persons. Furthermore, the DSB held that the processing activities leading to the creation of these marketing scores constitute profiling within the meaning of Article 4(4) GDPR. Taking into account recital 71 GDPR and [https://ec.europa.eu/newsroom/article29/items/612053 WP 251 rev.01], the DSB emphasized that the GDPR differentiates between profiling under Article 4(4) GDPR and automated decision making under Article 22 GDPR: for a processing activity to qualify as profiling it is not necessary that this processing activity is carried out solely automated. The DSB then assessed, whether the complainant had a right to information under Article 15(1)(h) GDPR regarding the marketing scores and whether the respondent had infringed that right, which required an interpretation of said provision. According to the DSB, the right under Article 15(1)(h) GDPR is not limited to cases of automated decision making under Article 22(1) and (4) GDPR, but also encompasses other cases, such as the profiling at hand: the use of the words "at least in those cases" Article 15(1)(h) points toward a broad scope of application. Consequently, the DSB saw no necessity to further assess whether the creation of the marketing also qualifies as automated decision making under Article 22 GDPR. Lastly, the DSB waived the respondent's argument, that the respondent was exempt from providing information under Article 15(1)(h) GDPR, because the logic involved calculating the marketing scores qualifies a trade secret within the meaning of § 4(6) DSG. The DSB explained that the respondent is not required to disclose the algorithm, source code or compiler code that was used when creating the marketing scores (such information would most likely qualify as a trade secret under Directive 2016/943/EU according to the DSB). Rather the respondent is required to provide the following information in connection with the score calculation: * parameters / input variables and how they came about (e.g. using statistical information); * effect of the parameters/input variables on the score; * explanation of why the data subject was assigned to a particular evaluation result; * list of possible profile categories or * similar equivalent information that enable the data subject to exercise his or her rights of rectification and erasure and to review the lawfulness of processing. As a general remark, the DSB held § 4(6) DSG as an exemption of a controller's obligations under Article 15 GDPR must be interpreted narrowly in light of Article 8 ECHR, Article 8 CFR and § 1(3) DSG (right to data protection under Austrian constitutional law).