- in European Union
On the 27th of February 2025 the Court of Justice of the European Union (CJEU) in its First Chamber delivered a preliminary reference balancing the rights of a data subject and their right to an explanation and the protection of trade secrets.
Facts:
The case concerned CK, whose creditworthiness was assessed via automated decision-making ("ADM") by third-party company Dun & Bradstreet Austria GmbH ("D&B"), resulting in rejection for a mobile phone contract. CK challenged the outcome before the Austrian Data Protection Authority, which ruled in his favour due to D&B's failure to explain the ADM logic. D&B claimed further disclosure would endanger trade secrets, but although the Federal Administrative Court upheld the decision, the Vienna City Council declined enforcement, stating D&B had met its legal obligations. The case was ultimately referred to the Court of Justice of the European Union ("CJEU").
Opinion of the CJEU:
The CJEU addressed two main issues:
- the scope of the data subject's right of access under Article 15(1)(h) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR") in cases involving ADM; and
- the potential conflict between this right and the protection of trade secrets.
The Court held that data subjects are entitled to clear, concise, and accessible explanations of the procedures and principles behind ADM, including profiling, to ensure a meaningful understanding of how personal data is processed. This supports the GDPR's broader transparency obligations, allowing individuals to verify the lawfulness of such processing.
However, access rights are not absolute. When the requested information is considered a trade secret, the controller must submit all protected material to the competent supervisory authority or court, which will then balance the data subject's right of access with the legitimate interests of protecting intellectual property or trade secrets. If necessary, safeguards must be implemented to prevent disclosure that would harm competing rights or freedoms, while still ensuring an appropriate level of transparency for the data subject.
Conclusion:
The CJEU, in its decision, confirmed that the mere existence of a trade secret and its potential conflict with data access rights should not be used to deny access, particularly in the case of logic which underlies the ADM. This is balanced with the disclosure of such trade secrets being subject to confidentiality, therefore striking a balance between the two rights. This is especially relevant considering the rise in the use of ADM, particularly through the prolific use of AI models.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
