Automated credit scoring: the right to a comprehensible explanation

A ten-euro contract refused

A mobile phone contract for ten euros a month, and the provider says no, her creditworthiness isn't good enough. That is what happened to a woman in Austria. The basis was an automated credit assessment by the credit agency Dun & Bradstreet Austria. On 27 February 2025, the European Court of Justice ruled on the matter (case reference C-203/22): anyone affected by such a decision is entitled to an explanation they can actually understand. A mathematical formula is not enough, and a trade secret is no reason to refuse all information.

The woman had asked the credit agency how the result had come about. The answer was a score, a numerical value intended to express the likelihood of her future payment behaviour. Along with it came the remark that certain socio-demographic data had been "weighted equally among themselves". That was all she learned. The company refused to provide further details, invoking a trade secret, that is, knowledge a company is entitled to protect from its competitors.

From Vienna to Luxembourg

The Austrian data protection authority ordered the credit agency to disclose meaningful information about the logic behind the decision. The Federal Administrative Court confirmed this in October 2019. The explanations were not sufficient to understand how the score had been arrived at. The credit agency nevertheless provided nothing further. When the woman sought to have the decision enforced, the Vienna municipal authority refused: the company had, it said, already sufficiently complied with its obligation.

Since the ruling, the company had not provided a single piece of additional information. How it was supposed to have met its obligation in doing so remained unclear. The Vienna Administrative Court, which had to decide the case, referred it to the ECJ. Two questions were at stake: what exactly a credit agency must disclose about an automated decision, and whether a trade secret may override that obligation.

What the right of access requires

The GDPR gives everyone the right to request information from a company about their own data. This is set out in Article 15. Where there is an automated decision, meaning a computer decides on a contract or a loan without human review, more is required: meaningful information about the "logic involved". That was the term at issue. The Court understands it as a right to an explanation. The company must explain the procedure and the principles by which it turned the person's data into a result such as a creditworthiness profile.

The purpose is a practical one. Anyone who does not know the reasons for a decision can neither put their point of view nor challenge the decision. Both are rights the GDPR grants to data subjects in the case of automated decisions. Without a comprehensible explanation, they come to nothing.

A formula alone is not enough

What must the explanation look like? The ECJ starts from comprehensibility. The information must be precise, transparent, intelligible and easily accessible. A complex mathematical formula, such as the algorithm itself, does not meet that standard. Nor does a detailed description of every single calculation step. Both overwhelm data subjects instead of informing them. Conversely, the credit agency does not have to disclose the algorithm in full either.

What is required is a description from which the person can see which of their data was used and in what way. The Court gives an example that fits credit assessments: it could be sufficient to tell the person to what extent a variation in the data taken into account would have led to a different result. In other words, an indication of whether a different value for a particular characteristic would have changed the score, and by how much. Information like that is something you can work with.

That also makes the ruling interesting for AI systems. Whether a decision is based on a simple points table or a learning model makes no difference to the entitlement. The Court says expressly that the complexity of the processing steps does not release the controller from its duty to explain. Anyone using a system whose results they cannot explain has a problem of their own making.

Trade secrets as an excuse

That leaves the trade secret. The Court concedes that data protection is not an unlimited right. Trade secrets and the rights of third parties deserve protection. But that must not result in the data subject receiving no information at all. Where there is a conflict, the interests must be weighed against each other, and on a case-by-case basis.

That balancing exercise is not for the company to carry out itself. If it considers information to be confidential, it must submit it to the competent supervisory authority or to the court. It is there that it is decided what the person learns and what they do not. A provision such as the Austrian one, which ruled out the right of access as a matter of principle as soon as a trade secret would be endangered, is therefore not applicable. A member state may not pre-empt the outcome of that balancing exercise across the board.

Access to information after a credit assessment

The ruling applies in exactly the same way to consumers in Germany, because the GDPR applies uniformly throughout the EU. Anyone refused a contract, a loan or an instalment plan because of an automated credit assessment can demand more from the credit agency than a number with a footnote. The first step is a request for access that expressly asks for an explanation: which data was used, in what way, and what change to that data would have led to a different result.

It also makes sense to ask for the precise profile that was transmitted to the provider who refused. In the Austrian case, the credit agency had in fact certified the woman as having very good creditworthiness. The profile sent to the mobile phone provider, by contrast, gave the impression that she had no creditworthiness at all. The Court makes it clear that this profile must be explained too.

If the company responds with a formula, with jargon or with a reference to trade secrets, that does not amount to sufficient information under the ruling. What then remains is a complaint to the data protection supervisory authority or recourse to the courts. Both must carry out the balancing exercise if the credit agency invokes confidentiality.