- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case W252 2246581-1/6E – Court Ruling (Austria, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a credit ranking agency must provide more information about how it processes personal data for creditworthiness assessments. This decision is significant because it reinforces the rights of individuals to understand automated decision-making processes that affect them.
What happened
The court ordered the credit ranking agency to disclose information about the logic behind its automated decision-making.
Who was affected
The individual who filed a complaint against the credit ranking agency regarding their creditworthiness assessment.
What the authority found
The court upheld that the agency must explain the logic of its processing, even if it does not have to reveal the exact algorithm used.
Why this matters
This ruling highlights the importance of transparency in automated decision-making. It encourages companies to be clear about how they use personal data, which is crucial for building trust with users.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject filed a complaint against the controller - a credit ranking agency. In the original procedure before the Austrian DPA, the data subject claimed that their rights resulting from Article 15(1)(h) GDPR were infringed as the controller did not sufficiently inform them about the logic and algorithm used for the processing of their personal data in the context of an automated decision about the data subject's creditworthiness. The controller replied that the processing at issue was not 'automated decision-making' pursuant to Article 22 GDPR, but only 'light profiling' under Article 4(4) GDPR. Therefore, the controller claimed that Article 15(1)(h) GDPR did not apply in the first place. Moreover, the controller argued that the algorithm regulating profiling could not be disclosed, being part of business secrets of the company. The Austrian DPA upheld the complaint and issued a decision against the controller, ordering the latter to provide access to the information requested by the data subject. The controller appealed the decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), stating that they provided the data subject with sufficient information. The court upheld the controller's appeal. First, the court noted that, according to Article 15(1)(h) GDPR, in case of automated decision-making the controller shall provide the data subject with an explanation about the logic behind the processing. However, this 'logic' shall not be understood as the algorithm or mathematical formula underlying the automated decision. Rather, the controller shall provide the following pieces of information: a) categories of personal data and why they are relevant to the creation of the profile; b) how the profile is created by automated means, with specific regard to the statistical method used; c) why the profile is relevant for the decision; d) how the profile is actually used in the context of the decision. In the case at issue, the c
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W252 2246581-1/6E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
29 June 2023
Authority
DPA DPA
About this data
Cite as: Cookie Fines. Court case W252 2246581-1/6E - Austria (2023). Retrieved from cookiefines.eu
Last updated: