How was my score calculated? CJEU strengthens the right of access

The case

In Case C-203/22 (Dun & Bradstreet Austria), an Austrian mobile network operator had refused to extend a customer's contract because an automated creditworthiness assessment by a credit reference agency was negative. Through the Austrian data protection authority, the customer demanded to know how this assessment had been arrived at — and initially succeeded before the Austrian Federal Administrative Court. However, because the credit reference agency still did not provide her with sufficient information afterwards, she had to have the decision enforced separately before the Administrative Court of Vienna. It was only in these enforcement proceedings that the court referred the decisive questions to the CJEU.

The CJEU's decision

In its judgment of 27.2.2025, the CJEU (EuGH) ruled that data subjects are entitled under Art. 15(1)(h) GDPR to meaningful information about the logic involved. The company must explain the procedures and principles actually applied in the automated processing of the data in a concise, transparent, intelligible and easily accessible form. The Court does not require disclosure of the complete algorithm. However, a mere mathematical formula or a purely technical, general description is not sufficient either — as a rule, neither would be intelligible to the data subject.

What an explanation may look like

The Court itself indicates what a sufficient explanation may look like in concrete terms: it may already be sufficient to inform the data subject of the extent to which a variation in the data taken into account would have led to a different result — for example, by how much a higher income or a shorter contract term would have changed the result. Such an explanation makes the decision comprehensible without disclosing the entire assessment model.

Trade secrets and third-party data

The company cannot rely on trade secrets or third-party data across the board in order to refuse access. If it relies on them, it must submit the allegedly protected information to the competent supervisory authority or the court, which will then weigh up the conflicting interests and determine the scope of the right of access.

Assessment for practice

At the same time, the case shows that a right of access, however clear it may be on paper, can be hard-won in practice — here, a final judgment, separate enforcement proceedings and, in the end, even a court-appointed expert were necessary to disclose the details of the score. Anyone who has been rejected on the basis of a credit score should therefore request access in writing under Art. 15 GDPR, including information about the logic of the decision, and, if there is no response or an inadequate one, should not hesitate to involve the data protection supervisory authority. The one-month deadline under Art. 12(3) GDPR applies to the response.