CJEU: individuals are entitled to a meaningful explanation of automated decisions (C-203/22)

In Case C-203/22 (CK v Magistrat der Stadt Wien; the credit scoring was performed by Dun & Bradstreet Austria), the Court of Justice held on 27 February 2025 that the GDPR right of access to 'meaningful information about the logic involved' in automated decision-making (Article 15(1)(h)) requires an intelligible explanation of the procedure and principles actually applied to the person's data to produce the result — for example, which factors drove a credit score. Supplying a complex mathematical formula or an algorithm does not satisfy the right. Trade-secret protection under Directive (EU) 2016/943 does not override it: where a controller claims protected information, the contested material may have to be put before the competent court or authority, which balances the rights at stake.

This sets the transparency bar for every automated decision with legal or similarly significant effect — credit, screening, eligibility — and it binds now, independent of the AI Act's timeline. 'The model is a trade secret' is no longer a complete answer to an access request, and explanation capability becomes a design requirement for scoring systems and the processes around them.

Organisations using automated decision-making or profiling with significant effects on individuals, the vendors that supply scores or decisions into those processes, and the legal teams that answer GDPR access requests about them.