ADM and transparency: algorithm disclosure is not required

CJEU confirms in new judgment that if you use automated decision-making, you are not required to reveal your algorithm(s) to data subjects (para. 59), but you might be required to “inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result” (para. 62).

The reason? You have to ensure that the information you provide on automated decision-making (ADM) is “concise, transparent, intelligible and easily accessible form, using clear and plain language”, in accordance with Art. 12(1) GDPR.

Does the algorithm or additional information have to be revealed to a supervisory authority?

The CJEU stresses the non-absolute nature of the right to the protection of personal data and the fact that other fundamental rights and freedoms have to be taken into account (para. 68 – the CJEU doesn’t mention it explicitly, but the freedom to conduct a business is one of the essential ones in this particular instance). Plus, the right of access “should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software” (Recital 63 GDPR; see also para. 69 & 71 of the judgment).

However, if some of the information to be provided “is likely to result in an infringement of the rights and freedoms of others, in particular in so far as it contains personal data of third parties protected by [the GDPR] or trade secrets”, “that information must be disclosed to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access to personal data concerning him or her” (para. 74).

Does that apply to algorithms?

No! If you have “concise, transparent, intelligible and easily accessible form, using clear and plain language” to provide regarding ADM, that’s fine. Explaining the logic, for instance an illustration of what would have been different if the data had been different, is perfectly possible without providing the algorithm itself.

This consideration is for situations where you consider that even that logic itself is a trade secret.

So think carefully about how to communicate about ADM to data subjects.

EDIT: post on forced trade secret disclosure here: https://lnkd.in/eeQaKqdP

Judgment in case C‑203/22, 27 February 2025, Dun & Bradstreet (currently only in French & German – EDIT: more languages now available): https://lnkd.in/eKkNYiqv

GDPR data protection privacy