Skip to main content
Praxikon

Ruling

Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal

Date
Status
final
Body
Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
Reference
C-203/22, ECLI:EU:C:2025:117

What it is about

Question: what does the right to meaningful information about the logic of automated decision-making involve, and may a controller refuse it by invoking trade secrets? Ruling: the controller must describe, concisely, transparently and intelligibly, the procedure and principles actually applied so the data subject understands which data were used and how. Merely handing over an algorithm is insufficient; explaining how a different input would have changed the result may be appropriate. Where trade secrets or third party data are involved, the controller must provide the information to the authority or court, which balances the interests. A national rule excluding access as a rule where trade secrets are at stake is not permitted.

What this means in practice

If you use automated decisions or scores, you must be able to give a plain language explanation per decision: which data, which rules and what weight. Build this in when choosing models and vendors, because a model you cannot explain produces a request you cannot answer. Trade secrecy is no free pass; prepare to share the sensitive details with the authority or court.

The GDPR articles concerned

Source: EUR-Lex, arrest C-203/22checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines

Enforcement and fines

Legislation in motion