How Much Information Needs To Be Provided To Data Subjects About Automated Decisions?

Earlier this year, we gave an overview of the Attorney General's opinion on Case C-203/22 (Dun & Bradstreet Austria) regarding information required to be provided to data subjects about automated decisions. The CJEU affirmed the Attorney General's opinion in its recent judgment, finding that where data subjects request access to information about an automated decision that a controller considers is protected by a trade secret, controllers must disclose the trade secret to a competent court or supervisory authority for assessment. In this briefing, we discuss the practical implications of this decision for organisations that utilise automated decision making processes (including for credit scoring decisions).