What happened. An Austrian mobile operator refused a customer a contract worth €10 a month because an automated credit assessment by Dun & Bradstreet Austria rated her creditworthiness as insufficient. An Austrian court found, by final decision, that the company had breached the General Data Protection Regulation by failing to give her 'meaningful information about the logic involved' in the automated decision. The court enforcing that decision asked the Court of Justice what this obligation requires in practice. The judgment was delivered on 27 February 2025 (CJEU press release No 22/25).
What the Court said. The controller must describe the procedure and principles actually applied, so that the person can understand which of their personal data were used and how. It may be appropriate to explain to what extent a variation in the data taken into account would have led to a different result. The mere communication of an algorithm is not a sufficiently concise and intelligible explanation. Where the controller claims that the information includes trade secrets or third parties' data, it must give that information to the competent supervisory authority or court, which balances the interests and decides how much the person may see. A national rule excluding access as a general matter whenever a trade secret is at stake is incompatible with the GDPR.
Context. The ruling builds on SCHUFA (C-634/21, December 2023), in which the Court held that an automated score can itself be an 'automated decision' under Article 22 GDPR. Together the two judgments give the right to contest automated decisions concrete content: first, scoring falls within the rules; second, the person is owed an explanation capable of supporting a challenge.
Why it matters for public administration. The case concerned a private company, but the same GDPR provisions bind public bodies that use automated risk scoring in benefits, tax or immigration. The documented failures of automated administration, from the Dutch childcare-benefits affair to Robodebt, turned in part on people being unable to learn why they had been flagged. An explanation standard framed around what would have changed the result is closer to what an appellant needs than a description of a model.
What to watch. How national courts and data-protection authorities apply the 'understand and challenge' test; the handling of trade-secret claims by authorities; and the interaction with Article 86 of the EU AI Act, which gives people affected by certain high-risk AI decisions a separate right to an explanation once those rules apply.