# data[].attributes.attachment_link.readable_text
In C-203/22, Dun & Bradstreet Austria, the Court of Justice of the European Union delivered an important decision on algorithmic transparency.
1. The facts of the case
CK (hereinafter also referred to as the " data subject") requested a contract extension from its telephone provider. The telecom company contacted Dun & Bradstreet (also " D&B "), a credit rating agency, which, in turn, gave a negative prognosis on CK's financial reliability. The data subject's request was, therefore, rejected.

The decision surprised CK. The contract extension only amounted to about EUR 10 per month, certainly within their financial reach. They had never had financial problems, so the decision sounded unreasonable.

The data subject presented the matter before the Austrian data protection authority, which directed D&B to provide CK with insights into the underlying logic of the automated decision-making process. In the subsequent appeal before the Bundesverwaltungsgericht (Federal Administrative Court of Austria), D&B raised several defences, including the existence of alleged trade secretsprotecting its software.

The Austrian court rejected this position and held that D&B had violated Article 15(1)(h) GDPR. More precisely, the company had failed to provide " CK with meaningful information about the logic involved in the automated decision-making based on personal data concerning CK, or, at the very least, [failed] to give a sufficient statement of reasons as to why it was unable to provide that information " (paras. 17-18).

The decision was not appealed and became final. Therefore, CK requested the City Council of Vienna to enforce the judgment, i.e. order to release the information. The Viennese public officials refused to proceed. They argued, in essence, that the operative part of the judgment did not provide clear instructions about the enforcement order. In other words, it was unclear which specific information had to be obtained from the controller.

CK brought an action against the decision of the City Council of Vienna before the Verwaltungsgericht Wien(Administrative Court, Vienna, Austria) which, in turn, referred six questions to the CJEU. The CJEU regrouped the questions into the following two main points:

(i) on the definition of " meaningful information" and " logic involved " under Article 15(1)(h) GDPR in the case of automated decisions under Article 22 GDPR; in other words, whether there is a right to an explanation of the algorithmic decision;

(ii) on the limits of such a right with respect to two specific opposing interests: the controller's trade secrets and the personal data of third parties.
2. The CJEU decides on algorithmic transparency
With this decision, the CJEU provides clear guidance on algorithmic transparency and balancing of opposing interests. There was indeed a pressing need for it, as indicated by the tumultuous doctrinal debate that offered a wide range of viewpoints.

(i) On the existence of a right to an explanation of the algorithmic decision

The Court confirms the right to explanation of automated decision- making under the GDPR. To do so, it essentially employs two arguments.

Firstly, the Court draws attention to the wording of Article 15(1)(h) GDPR.

The judges first focus on the expression " meaningful information". The English term " meaningful", they observe, has different equivalents in other language versions of the GDPR. For example, the Dutch " nuttige" and the Portuguese " ùteis" emphasise the functional aspect of information. The Romanian version focuses on relevance (" pertinente"). The Polish and Spanish versions, on the other hand, refer to the importance ofthe information (" istotne" and " significativa"). Finally, the English and German versions (respectively " meaningful" and " aussagekräftig") lean towards the idea of good intelligibility (para. 40). Such linguistic variety must be valued and considered in interpreting the GDPR. More precisely, " the various meanings set out in the preceding paragraph are complementary" (emphasis added) (para. 41). Accordingly, " meaningful" always means - or implies - that the information provided under Article 15(1)(h) must be, at the same time, functional, important, relevant, and intelligible.

The Court then shifts its focus onto analysing the phrase " logic involved". Here again, the judges use the different language versions of the GDPR. This time the Court refers to the Czech and Polish versions, in which the expression is respectively translated with the terms " postupu" and " zasadi", i.e. " procedures" and " principles". The Court concludes as follows: the " logic involved" referred to in Article 15(1)(h) " covers all relevant information concerning the procedure and the principles" (emphasis added) of a " specific result" (paras. 42-43).

Secondly, the Court uses a teleological argument in support of the previous interpretation (para. 50).

The judges recall the functional value of Article 15 GDPR. The right of access is an essential tool enabling the data subject to verify the lawfulness of the processing. The Court recalls its own case law for which the right of access is " necessary to enable the data subject to exercise " its right to rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), objection to processing (Art. 21), court action (Art. 79) and right to compensation (Art. 82) (paras. 53-54).

At this point, an innovative element comes into play. For the first time to our knowledge, the CJEU goes a step further and expressly adds to the rights listed in the preceding paragraph also the rights foreseen under Article 22(3) GDPR. In other words, the right of access under Article 15(1)(h) GDPR is instrumental " to effectively exercise the rights conferred on him or her by Article 22(3)" (para. 55). Conversely, the Court continues, it would be impossible for an individual subject to automated processing or profiling to express their views on the decision and effectively challenge it, as required by Article 22(3) GDPR (para. 56).

Pursuant to Art. 12(1) GDPR, the explanations must be provided in a concise, transparent, intelligible and easily accessible manner. In this respect, and here comes another relatively new element, the Court clarifies that the complexity of the automated processing operations does not justify the lowering of this transparency threshold (para. 61).

Finally, the Court sides with the data subject, requiring the controller " to explain in a concise, transparent, intelligible and easily accessible form the procedure and principles pursuant to which the result of the 'actual' profiling was obtained " (para. 65).

(ii) On the relationship between the explanation of the algorithmic decision and other protected interests. Trade secrets and personal data of third parties

In the first part of the decision, the Court confirms the right to an explanation of automated decision-making. The explanation must put the data subject in a position to effectively understand it, express their point of view, and contest it. This implies a disclosure by the controller, the extent of which depends on the type of decision a data subject intends to contest.

For example, the problem may lie in how a calculation is made, so the controller shall disclose something about its algorithm. In other cases, problems may stem from the type of data processed. If the data subject wants to find and contest that discrimination, the disclosure may involve the personal data of third parties.

The second part of the ruling explores the relationship between the right to explanation and two conflicting interests, trade secrets and personal data. The decision, however, does not provide much guidance.

The Court recalls its own precedent, Norra Stockholm Bygg, C-268/21 (para 58). In that case, the CJEU had already accepted that a national court may authorise full or partial disclosure of third parties' personal data in favour of a complainant. On one condition, such disclosure had to be necessary to ensure the effectiveness of rights guaranteed by Article 47 of the EU Charter of Fundamental Rights.

The Court expressly states that this precedent " can be fully transposed" to the case at hand. Accordingly, if Article 47 EU Charter so requires, third-party personal data and controller's trade secrets " must be disclosed to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject's right of access to personal data concerning him or her " (para. 74).

Regrettably, the decision merely states that the balancing must be carried out on a case-by-case basis (para. 75).
3. Final remarks
Dun and Bradstreet is an important ruling.

We appreciate the literal interpretation based on the different language versions of the GDPR. This approach, which respects the principle of equality of the languages of the Union, clarified the expressions " meaningful information" and " logic involved ". Should the Court consistently adopt such multi-lingual approach in the future, there might be interesting novelties ahead.

The teleological argument should also be welcomed. It is consistent with existing case law and even goes a step further, establishing the principle of algorithmic transparency in the GDPR. For the first time, it expressly links the right of access to the rights to react to automated decisions, enshrined in Art. 22(3) GDPR. Whenever the GDPR grants a right, be it a judicial remedy (Art. 79 and 82), or against the controller (16, 17, 18, 21 and, from now on, 22), that right must be effective in accordance with Art. 47 Charter. The disclosure to which the controller is bound must, therefore, comply with this standard, subject to appropriate balancing.

We also want to briefly discuss para. 61 of the ruling, where the Court states that the complexity of the processing is not a valid excuse for not providing the information in the manner specified by Article 12 GDPR. We wonder what should be done when the processing is so intricate that it cannot be explained in an understandable manner. This is not a theoretical scenario given the inherent complexity of certain AI systems. Could we reasonably conclude that if the processing is not explainable, it should be simplified or even interrupted? The implications of this assumption may have far-reaching consequences.

Finally, some uncertainty persists regarding the practical methods of disclosure. The Austrian courts had requested clarifications on whether a "black-box" system was necessary or appropriate to provide access to the parties while simultaneously safeguarding the controller's trade secrets or third parties' personal data. The Court did not provide specific guidance on this matter, merely stating that the DPA or the court in charge would determine the appropriate information to disclose to the data subject. In this regard, further elaboration could have been beneficial.

# data[].attributes.attachment_link.title
The Court of Justice of the European Union confirms the existence of the right to explanation of automated decision-making.

# data[].attributes.attachment_link.description
The CJEU confirmed the link between the right of access under Art. 15(1)(h) and the right to effectively challenge automated decisions under Art. 22(3) GDPR.

# data[].attributes.headline
(IAF) Assessments to an AI World: Legitimate Interest Assessment

# data[].attributes.subject
(IAF) Assessments to an AI World: Legitimate Interest Assessment

# data[].attributes.attachment_link.description
Assessments to an AI World: Legitimate Interest Assessment

# data[].attributes.headline
CNIL: Relying on the legal basis of legitimate interests to develop an AI system

# data[].attributes.subject
CNIL: Relying on the legal basis of legitimate interests to develop an AI system

# data[].attributes.attachment_link.title
Relying on the legal basis of legitimate interests to develop an AI system

# data[].attributes.attachment_link.description
This content is a courtesy translation of the original publication in French. In the event of any inconsistencies between the French version and this English translation, please note that the French version shall prevail.

# data[].attributes.headline
CJEU confirms preparatory acts can be automated individual decisions: the SCHUFA cases

# data[].attributes.subject
CJEU confirms preparatory acts can be automated individual decisions: the SCHUFA cases

# data[].attributes.attachment_link.title
CJEU confirms preparatory acts can be automated individual decisions: the SCHUFA cases

# data[].attributes.attachment_link.description
On 7 December, the Court of Justice of the European Union issued its judgment in the SCHUFA case (case C-634/21). The CJEU ruled that a credit reference agency engages in automated individual decision- making when it creates credit repayment probability scores as a result of automated processing and where lenders rely heavily on these scores (to establish, implement, or terminate contracts).

# data[].attributes.attachment_link.description
Your browser does not support the video tag.

# data[].attributes.headline
EC: Updated EU AI model contractual clauses

# data[].attributes.subject
EC: Updated EU AI model contractual clauses

# data[].attributes.attachment_link.description
This resource highlights the key updates to the revised EU AI model contractual clauses.

# data[].attributes.attachment_link.title
EU AI Act Compliance Checker | EU Artificial Intelligence Act

# data[].attributes.attachment_link.description
Data Privacy: In order to email your results to you we are required to store your inputs from this form, including your email address. If you do not use the email function, none of your data will be stored. We do not store any other data that could be used to identify you or your device. If you wish to remain anonymous, please use an email address that does not reveal your identity. We do not share any of your data with any other parties. If you would like your data to be deleted from our servers, please contact taylor@futureoflife.org

# data[].attributes.headline
Overview of all AI Act National Implementation Plans

# data[].attributes.subject
Overview of all AI Act National Implementation Plans

# data[].attributes.attachment_link.title
Overview of all AI Act National Implementation Plans | EU Artificial Intelligence Act

# data[].attributes.headline
FPF: Automated Decision-Making under the GDPR

# data[].attributes.subject
FPF: Automated Decision-Making under the GDPR

# data[].attributes.attachment_link.readable_text
On May 17, the Future of Privacy Forum launched a comprehensive Report analyzing case-law under the General Data Protection Regulation (GDPR) applied to real-life cases involving Automated Decision Making (ADM). The Report is informed by extensive research covering more than 70 Court judgments, decisions from Data Protection Authorities (DPAs), specific Guidance and other policy documents issued by regulators.
The GDPR has a particular provision applicable to decisions based solely on automated processing of personal data, including profiling, which produces legal effects concerning an individual or similarly affects that individual: Article 22. This provision enshrines one of the "rights of the data subject", particularly the right not to be subject to decisions of that nature (i.e., 'qualifying ADM'), which has been interpreted by DPAs as a prohibition rather than a prerogative that individuals can exercise.

However, the GDPR's protections for individuals against forms of automated decision-making (ADM) and profiling go significantly beyond Article 22. In this respect, there are several safeguards that apply to such data processing activities, notably the ones stemming from the general data processing principles in Article 5, the legal grounds for processing in Article 6, the rules on processing special categories of data (such as biometric data) under Article 9, specific transparency and access requirements regarding ADM under Articles 13 to 15, and the duty to carry out data protection impact assessments in certain cases under Article 35.

This new FPF Report outlines how national courts and DPAs in the European Union (EU)/European Economic Area (EEA) and the UK have interpreted and applied the relevant EU data protection law provisions on ADM so far - before and after the GDPR became applicable -, as well as the notable trends and outliers in this respect. To compile the Report, we have looked into publicly available judicial and administrative decisions and regulatory guidelines across EU/EEA jurisdictions and the UK. It draws from more than 70 cases - 19 court rulings and more than 50 enforcement decisions, individual opinions, or general guidance issued by DPAs, - from a span of 18 EEA Member-States, the UK, and the European Data Protection Supervisor (EDPS). To complement the facts of the cases discussed, we have also looked into press releases, DPAs' annual reports, and media stories.

Some examples of ADM and profiling activities assessed by EU courts and DPAs and analyzed in the Report include:

School access and attendance control through Facial Recognition technologies

Online proctoring in universities and automated grading of students

Automated screening of job applications

Algorithmic management of platform workers

Distribution of social benefits and tax fraud detection

Automated credit scoring

Content moderation decisions in social networks

Our analysis shows that the GDPR as a whole is relevant for ADM cases and has been effectively applied to protect the rights of individuals in such cases, even in situations where the ADM at issue did not meet the high threshold established by Article 22 GDPR. Among those, we found detailed transparency obligations about the parameters that led to an individual automated decision, a broad reading of the fairness principle to avoid situations of discrimination, and strict conditions for valid consent in cases of profiling and ADM.

Moreover, we found that when enforcers are assessing the threshold of applicability for Article 22 (" solely" automated, and " legal or similarly significant effects "), the criteria they use are increasingly sophisticated. This means that:

Courts and DPAs are looking at the entire organizational environment where ADM is taking place, from the controller's organizational structure, to reporting lines and the effective training of staff, in order to decide whether a decision was "solely" automated or had meaningful human involvement; and

Similarly, when assessing the second criterion for the applicability of Article 22, enforcers are looking at whether the input data for an automated decision includes inferences about the behavior of individuals, and whether the decision affects the conduct and choices of the persons targeted, among other multi-layered criteria.

A recent preliminary ruling request sent by an Austrian court in February 2022 to the Court of Justice of the European Union (CJEU) may soon help clarify these concepts, as well as other related to the information which controllers need to give data subjects about ADM's underlying logic, significance and envisaged consequences for the individual.

The findings of this Report may also serve to inform the discussions about pending legislative initiatives in the EU that regulate technologies or business practices that foster, rely on, or relate to ADM and profiling, such as the AI Act, the Consumer Credits Directive, and the Platform Workers Directive.

On May 20, the authors of the report discussed with prominent European data protection experts some of the most impactful analyzed decisions during an FPF roundtable. These include cases related to the algorithmic management of platform workers in Italy and the Netherlands, the use of automated recruitment and social assistance tools, and creditworthiness assessment algorithms. The discussion also covered pending questions sent by national courts to the CJEU on matters of algorithmic transparency under the GDPR. View a recording of the conversation here, and download the slides here.

# data[].attributes.attachment_link.title
FPF Report: Automated Decision-Making Under the GDPR - A Comprehensive Case-Law Analysis - Future of Privacy Forum

# data[].attributes.attachment_link.description
Today, the Future of Privacy Forum launched a comprehensive Report analyzing case-law under the General Data Protection Regulation (GDPR) applied to real-life cases involving Automated Decision Making (ADM). The Report is informed by extensive research covering more than 70 Court judgments, decisions from Data Protection Authorities (DPAs), specific Guidance and other policy documents issued by regulators.

# data[].attributes.headline
WP29: Guidelines on Automated individual decision-making and Profiling

# data[].attributes.subject
WP29: Guidelines on Automated individual decision-making and Profiling

# data[].attributes.attachment_link.title
JUSTICE AND CONSUMERS ARTICLE 29 - Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01)

# data[].attributes.attachment_link.description
This site uses cookies. Visit our cookies policy page or click the link in any footer for more information and to change your preferences.

# data[].attributes.headline
AI Privacy Risks & Mitigations Large Language Models (LLMs)

# data[].attributes.subject
AI Privacy Risks & Mitigations Large Language Models (LLMs)

# data[].attributes.attachment_link.title
AI Privacy Risks & Mitigations Large Language Models (LLMs) | European Data Protection Board

# data[].attributes.attachment_link.description
The AI Privacy Risks & Mitigations Large Language Models (LLMs) report puts forward a comprehensive risk management methodology for LLM systems with a number of practical mitigation measures for common privacy risks in LLM systems. In addition, the report provides use cases examples on the application of the risk management framework in real-world scenarios: