Skip to main content
Praxikon

Direct answer · GDPR

May an organisation refuse to explain an automated decision by invoking trade secrets?

Short answer

No, not entirely. The data subject has the right to meaningful information about the logic involved in an automated decision (Article 15(1)(h)). According to the Court of Justice in Dun & Bradstreet Austria, the organisation explains the procedure actually applied in an understandable way. Where trade secrets are at stake, it submits the information to the supervisory authority or the court, which weighs how much access the data subject receives.

Direct answer · GDPR

Explaining an automated decision and trade secrets

No, not entirely. The data subject has the right to meaningful information about the logic involved in an automated decision (Article 15(1)(h)). According to the Court of Justice in Dun & Bradstreet Austria, the organisation must explain the procedure and principles actually applied in such a way that the data subject understands how his or her personal data led to the result. If it considers that trade secrets or data of others are at stake, it submits that information to the supervisory authority or the court, which weighs how much access the data subject receives.

For you to establish

  • Which information does the organisation want to withhold, and why?

Articles

  • Art. 15(1)(h) GDPR Right to meaningful information about the logic involved.
  • Art. 15(4) GDPR The right to obtain a copy must not adversely affect the rights and freedoms of others.

Case law

  • Dun & Bradstreet Austria (CJEU, C-203/22, ECLI:EU:C:2025:117, 2025-02-27)Operative part: explanation of the procedure actually applied; where trade secrets are involved, the supervisory authority or court weighs the interests.

Guidelines and decisions

Read the article Check your own case General interpretation, not legal advice. The official source remains authoritative.

Check your own situation

Describe your system or project in the free case check and get a reasoned first assessment of, among other things, the DPIA obligation, Article 22 GDPR and the AI Act, with the source for every conclusion.

Go to the free case check
Zahed Ashkara, jurist and freelance AI & Privacy Consultant

Behind this page

Zahed Ashkara

Freelance AI & Privacy Consultant, jurist