On September 12, 2024, the Court of Justice of the European Union (CJEU) published Opinion ECLI:EU:C:2024:745 in Case C-203/22 regarding the interpretation of Article 15(1)(h) and 22 of the General Data Protection Regulation (GDPR).

Background

In particular, the case relates to a request for a preliminary ruling concerning an application for enforcement of a court order requiring a credit assessment undertaking to provide meaningful information about the logic involved in profiling relating to the defendant's personal data. The defendant was refused the extension of a mobile telephone contract on the grounds they did not have sufficient financial creditworthiness, substantiated by an automated credit assessment.

The Advocate General's opinion outlines what is understood by 'meaningful information about the logic involved' in automated decision-making within the meaning of Article 15(1)(h) of the GDPR, and how the right of access must be weighed against trade secrets.

Opinion of the Advocate General

The Advocate General outlined that they considered 'meaningful information about the logic involved' in automated decision-making must enable data subjects to exercise the rights guaranteed by the GDPR. Specifically, Article 22 of the GDPR and that they can obtain information that is concise, easily accessible, easy to understand, and formulated in clear and plain language on the method and criteria used for such decisions. Information must also be sufficiently complete and contextualized to enable the individual to verify its accuracy and whether there is an objectively verifiable consistency and causal link between the method and criteria used, and the result arrived at by the automated decision.

Further, the Advocate General opined that controllers cannot rely on the complexity of information to refuse their obligation under Article 15(1)(h) of the GDPR and that it falls to the controller to provide information that is both accessible and complete so that data subjects can understand the process that led to the automated decision. Data subjects must be able to understand what information was used in the automated decision-making and how it was taken into account and weighted. However, the Advocate General clarified that such interpretation of Article 15(1)(h) does not preclude controllers from deciding, on a voluntary basis, to provide data subjects with information of a technical nature.

Regarding trade secrets, the Advocate General noted that where data subject access and information provided is likely to infringe on the rights and freedoms of others, the information should be disclosed to the competent supervisory authority or court so that they can weigh up, the interests involved and determine the extent to which the right of access be granted.

You can read the Opinion here and access the case history here.