CJEU Case C-203/22 / Judgment
-
CJEU Case C-203/22 / Judgment
Key facts of the case:
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties
Outcome of the case:
On those grounds, the Court (First Chamber) hereby rules:
- Article 15(1)(h) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that, in the case of automated decision-making, including profiling, within the meaning of Article 22(1) of that regulation, the data subject may require the controller, as ‘meaningful information about the logic involved’, to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied in order to use, by automated means, the personal data concerning that person with a view to obtaining a specific result, such as a credit profile.
- Article 15(1)(h) of Regulation 2016/679 must be interpreted as meaning that, where the controller takes the view that the information to be provided to the data subject in accordance with that provision contains data of third parties protected by that regulation or trade secrets, within the meaning of point 1 of Article 2 of Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure, that controller is required to provide the allegedly protected information to the competent supervisory authority or court, which must balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access provided for in Article 15 of that regulation.
-
Paragraphs referring to EU Charter
51. As regards, lastly, the purposes of the GDPR, it should be recalled that the objective of that regulation consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data, enshrined in Article 16 TFEU and guaranteed as a fundamental right in Article 8 of the Charter, which supplements the right to private life guaranteed in Article 7 thereof (see, to that effect, judgment of 4 October 2024, Schrems (Communication of data to the general public), C‑446/21, EU:C:2024:834, paragraph 45 and the case-law cited).
...
68. In that regard, it should be recalled that, pursuant to recital 4 of the GDPR, the right to the protection of personal data is not an absolute right and must be balanced against other fundamental rights, in accordance with the principle of proportionality. Thus, the GDPR respects all the fundamental rights and observes the freedoms and principles recognised by the Charter, as enshrined by the Treaties (judgment of 26 October 2023, FT (Copies of medical records), C‑307/22, EU:C:2023:811, paragraph 59 and the case-law cited).
...
74. As to how the right of access enshrined in Article 15(1)(h) of the GDPR may be implemented in such a way as to respect the rights and freedoms of others, it should be recalled that, according to the case-law, a national court may take the view that the personal data of the parties or of third parties must be disclosed to it in order to be able to balance, in full knowledge of the facts and in accordance with the principle of proportionality, the interests involved. That assessment may, depending on the case, lead it to authorise the full or partial disclosure to the opposing party of the personal data thus communicated to it, if it finds that such disclosure does not go beyond what is necessary for the purpose of guaranteeing the effective enjoyment of the rights which individuals derive from Article 47 of the Charter (judgment of 2 March 2023, Norra Stockholm Bygg, C‑268/21, EU:C:2023:145, paragraph 58).
-
Paragraphs referring to EU Charter (original language)