Skip to content

Austrian Credit Agency Fined for GDPR Breaches in Automated Decision-Making

The court's ruling sets a precedent for transparency in automated decision-making. The agency must now disclose specific data usage and algorithmic logic.

In this picture we can see a close view of the identity card. In the front we can see american flag...
In this picture we can see a close view of the identity card. In the front we can see american flag and "Critical Licence" written.

Austrian Credit Agency Fined for GDPR Breaches in Automated Decision-Making

Austrian credit information agency faces penalties for GDPR breaches. The Austrian Federal Administrative Court ruled on May 28, 2025, that the agency violated GDPR requirements by failing to provide sufficient transparency about its automated decision-making processes.

The court's decision comes amidst increased scrutiny of automation across Europe. The UK has recently updated its data protection framework, and studies have highlighted significant accuracy issues in AI-powered systems. The agency was found to have processed data from multiple sources but failed to clearly indicate which specific data served which purposes.

The court rejected the agency's claims about trade secrets protecting algorithmic details, stating that the agency failed to provide specific evidence. The court applied the February 27, 2025 CJEU ruling in case C-203/22, which established that automated generation of creditworthiness scores constitutes automated decision-making under Article 22 GDPR when these scores significantly influence third-party contract decisions. The agency was also found to have violated Article 15(1)(h) GDPR regarding automation transparency, as it denied conducting automated decision-making under Article 22 GDPR.

The court ordered the agency to provide compliant information within four weeks or face execution proceedings. This includes sufficiently specific details about processing purposes and meaningful information about automated decision-making logic. The ruling emphasizes the importance of transparency in automated decision-making processes and sets a precedent for companies handling personal data.

Read also:

Latest