What happened

A customer in Austria was refused a EUR 10 a month mobile phone contract by an operator, which relied on an automated credit assessment from Dun & Bradstreet Austria, having requested details about how her creditworthiness was assessed, specifically seeking "meaningful information about the logic involved" in the automated decision-making.

In its refusal, Dun & Bradstreet, cited protection of trade secrets and third-party data. 

Austrian courts ruled that the company's refusal violated the General Data Protection Regulation (GDPR) as Dun & Bradstreet failed to provide sufficient explanation or justification for withholding the information. 

The case escalated to the Court of Justice of the European Union (CJEU), which clarified that data controllers must explain the procedures and principles used in automated decisions so individuals can understand and challenge outcomes.

Trade secrets or third-party data concerns must be balanced by courts or supervisory authorities, not used as blanket grounds for refusal, the ECJ said.

Why it happened

Dun & Bradstreet relied on an Austrian legal provision allowing companies to withhold information if disclosure would compromise business or trade secrets.

However, the courts determined that this national rule could not override GDPR rights.