Dun & Bradstreet refuses to reveal Austrian telephone company customer details

Dun & Bradstreet Austria unlawfully withheld meaningful information about its automated credit assessment process from a customer denied a mobile phone contract, leading to a landmark ruling on data subject rights. What happened A customer in Austria was refused a EUR 10 a month mobile phone contract by an operator, which relied on an automated credit assessment from Dun & Bradstreet Austria, having requested details about how her creditworthiness was assessed, specifically seeking "meaningful information about the logic involved" in the automated decision-making. In its refusal, Dun & Bradstreet, cited protection of trade secrets and third-party data. Austrian courts ruled that the company's refusal violated the General Data Protection Regulation (GDPR) as Dun & Bradstreet failed to provide sufficient explanation or justification for withholding the information. The case escalated to the Court of Justice of the European Union (CJEU), which clarified that data controllers must explain the procedures and principles used in automated decisions so individuals can understand and challenge outcomes. Trade secrets or third-party data concerns must be balanced by courts or supervisory authorities, not used as blanket grounds for refusal, the ECJ said. Why it happened Dun & Bradstreet relied on an Austrian legal provision allowing companies to withhold information if disclosure would compromise business or trade secrets. However, the courts determined that this national rule could not override GDPR rights. What it means The ruling clarifies that companies using automated decision-making must provide individuals with clear, intelligible explanations of how their data is used and how decisions are made, even where trade secrets are involved. Any claimed confidentiality must be assessed by a competent authority, ensuring a balance between transparency and legitimate business interests. The decision strengthens individual rights in the face of automated profiling and credit assessments, setting a precedent for greater transparency and accountability in the use of algorithms in consumer decisions across the EU. It also limits the ability of companies to use trade secret protections to avoid GDPR obligations, promoting fairer treatment and recourse for consumers.

Date it happened

2019-01-01

Organisation involved

Dun & Bradstreet Austria

Product, system or model

Credit Scoring Algorithm

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.