Mrs. B – Court Ruling (Austria, 2022)

The Austrian DPA decided that the data controller specialising in credit assessments (C. Ges.m.b.H.) had to disclose meaningful information about the logic involved in the automated decision-making process concerning the data subject's data on the issue of her creditworthiness despite the algorithm being protected by trade secrets. This decision was then appealed by the data controller to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). Reportedly, such algorithms may be protected under Article 2(1) Directive 2016/943. The right to access personal information in an automated decision under Article 15(1)(h) GDPR is given additional meaning in enabling the data subject to contest such a decision under Article 22(3) GDPR. Thus, the Federal Administrative Court upheld that the data controller had infringed the data subject’s right to access her data related to an automated decision since the controller did not provide meaningful information on the logic involved in the decision under Article 15(1)(h) GDPR. However, after the ruling, the data controller did not provide further information. Hence, the data subject made an application for enforcement to the enforcement authority, the Vienna City Council, which did not fulfil its obligation and used a power it was not entitled to, as it found that the controller had already sufficiently fulfilled its obligation to provide information, despite the controller not providing any further information. According to Austrian law, since the data controller's complaint against the decision of the executing authority was admissible, and the executing authority did not fulfil its obligation, the administrative courts of first instance must, therefore, take a decision in the present proceedings instead of the executing authority. In light of this, the Regional Administrative Court Vienna (Verwaltungsgericht Wien - VGW) attempted to answer the question of whether a data controller can refuse to provide the data subject with meaningful information related to the use of algorithms for automated decision-making under Article 15(1)(h) GDPR where (parts of) such algorithms are protected by trade secrets. The VGW maintains that the rights under Article 15(1)(h) GDPR and Article 22(3) GDPR must enable the data subject to question the validity of the information received, as well as assess whether it corresponds with profiling on them. However, it identifies a tension where the information requested by a data subject and required for their understanding of an automated decision stems from an algorithm protected under EU trade secrets law. The VGW suggests the possibility of alleviating this tension by disclosing the information concerned only to the relevant authority or court and letting them determine whether a trade secret under Article 2(1) Directive 2016/943 is present as well as whether the data corresponds to information required to be provided under Article 15(1) GDPR. The VGW holds that refusing to provide such information could constitute a violation of Article 47 CFR and can therefore only be narrowly justified, whilst maintaining that there is insufficient existing EU law and guidance to provide a clear answer on this matter. Thus, the central question it poses to the CJEU for a preliminary ruling is whether information on the functioning of the profiling must be disclosed to the data subject where such information is protected by trade secrets.