Mrs. B – Court Ruling (Austria, 2022)

The Austrian DPA decided that the data controller specialising in credit assessments (C. Ges.m.b.H.) had to disclose meaningful information about the logic involved in the automated decision-making process concerning the data subject's data on the issue of her creditworthiness despite the algorithm being protected by trade secrets. This decision was then appealed by the data controller to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). Reportedly, such algorithms may be protected under Article 2(1) Directive 2016/943. The right to access personal information in an automated decision under Article 15(1)(h) GDPR is given additional meaning in enabling the data subject to contest such a decision under Article 22(3) GDPR. Thus, the Federal Administrative Court upheld that the data controller had infringed the data subject’s right to access her data related to an automated decision since the controller did not provide meaningful information on the logic involved in the decision under Article 15(1)(h) GDPR. However, after the ruling, the data controller did not provide further information. Hence, the data subject made an application for enforcement to the enforcement authority, the Vienna City Council, which did not fulfil its obligation and used a power it was not entitled to, as it found that the controller had already sufficiently fulfilled its obligation to provide information, despite the controller not providing any further information. According to Austrian law, since the data controller's complaint against the decision of the executing authority was admissible, and the executing authority did not fulfil its obligation, the administrative courts of first instance must, therefore, take a decision in the present proceedings instead of the executing authority. In light of this, the Regional Administrative Court Vienna (Verwaltungsgericht Wien - VGW) attempted to answer the question of whether a data controller can refuse to provide the data subjec