Data Protection Authority
Obligation to inform in automatic decision-making
7th March 2025
The European Court of Justice (ECJ) concluded that in the case of automatic decision-making, the controller must provide the person concerned with information about the process and the rules that were actually applied in the decision-making process, according to the General Data Protection Regulation (GDPR).
The Court observed that if sensitive business secrets had an impact on the information provided, the controller should provide the relevant court or data protection agency with the information in question so that an assessment can be made of the extent of the individual's rights to access to their personal data.
The judgment further strengthens the rights of individuals when it comes to automatic decision-making and calls for greater transparency in the processing of personal data.