Algorithmic transparency and trade secrets in access to personal data requests: Insights from case C‑203/22 

The interaction between algorithmic transparency and trade secrets has become a crucial issue, especially in today’s digital age where the use of AI is becoming increasingly widespread. In his Opinion delivered in case C‑203/22, Advocate General (AG) de la Tour of the Court of Justice of the European Union (CJEU) provided valuable insights on how to balance these two aspects. This article will outline the key elements of the AG Opinion, focusing on how organisations using AI in decision making can balance transparency with protecting their trade secrets when handling personal data access requests under Regulation 2016/679 (GDPR).  

The Case

At the core of case C‑203/22 was a situation involving an Austrian citizen who was denied a mobile phone contract following an automated credit check. The decision was fully automated, with no human involvement. Seeking to understand why her application was rejected, the individual requested information on how her personal data was processed and the logic behind the automated decision, as granted under Article 15(1)(h) GDPR. However, the company refused to provide detailed information, arguing that the algorithm it used was protected as a trade secret under Directive (EU) 2016/943.  

The Administrative Court of Vienna stayed the proceedings and referred six questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling, asking for the interpretation of the right of access under Article 15 GDPR when exercised in relation to automated decision-making. The Opinion delivered by the AG is meant to assist the CJEU in making its decision, therefore even if often influential, it is not binding on the Court. 

The Core Question: How Much Transparency is Required?

This case raises a fundamental question: To what extent are organisations required to disclose details about AI-driven decisions to individuals impacted by them?  

According to Article 15(1)(h) of the GDPR, individuals have the right to be informed by the controller of the existence of automated decision-making, including profiling, as referred to in Article 22 of the GDPR. Where that is the case, individuals have the right to obtain “meaningful information” about the logic behind automated decisions that affect them. But what exactly does this mean? 

As clarified by the CJEU in case C‑634/21, “automated decision-making” under Article 22 of the GDPR refers to decisions or other acts taken or performed without human intervention that have legal effects or similarly significant effects on the individual. Examples of such decisions may be the automatic refusal of an online credit application or e-recruiting practices without human intervention. In such cases, Article 22 of the GDPR requires the data controller to implement adequate safeguards to protect the rights, freedoms and interests of the individual. This may include allowing the individual to obtain human intervention and to challenge the decision.  

Article 15(1)(h) of the GDPR is aimed at ensuring that the individual is provided with enough information to exercise the rights conferred by Article 22 GDPR, namely to express their opinion and challenge the decision that affects them. The term “meaningful information” under Article15(1)(h) GDPR implies that individuals should be able to understand the factors considered in the decision-making process and the weight given to these factors. For example, if a bank denies a loan application based on automated decision-making, the applicant should be informed about which factors (such as credit score, income, or employment status) influenced the decision and how much influence each factor had. 

According to AG de la Tour, the information provided should be: 

• Clear and understandable: It must be presented in a way that a lay person can comprehend, without requiring advanced technical knowledge. 

• Comprehensive enough: The details should enable the individual to assess the accuracy of the decision and understand the link between the criteria used and the final outcome. 

In essence, while organisations are not expected to reveal complex mathematical formulas, or the technical intricacies of their algorithms, they must ensure that the decision-making process is made intelligible and transparent. 

Balancing Transparency with Trade Secrets

A major concern for organisations is how to protect their trade secrets, while fulfilling their transparency obligations. Many companies view their algorithms as proprietary assets that provide a competitive edge, and they are understandably cautious about sharing this information. AG de la Tour recognised this concern, but also made it clear that trade secrets cannot be used as a blanket excuse to avoid transparency obligations under the GDPR. 

If sharing certain information risks revealing trade secrets, or could harm the rights of others (for instance, disclosing personal data of other individuals), there are mechanisms to resolve this tension. In such cases, according to AG de la Tour, the information can be provided to a supervisory authority or court, which can then decide the extent to which the individual should be granted access.  

Key takeaways

• Transparency and accountability: Organisations using automated decision-making must provide clear and understandable information about how decisions are made, ensuring that individuals can understand and, if necessary, challenge these decisions. 

• Trade secrets are not absolute: While protecting trade secrets is important, it cannot be used as a blanket reason to withhold information. The rights of individuals to understand how decisions are made about them must be carefully balanced with the need to safeguard proprietary information. 

• Supervisory authorities can mediate: In cases where trade secrets might be compromised, or third-party rights negatively affected, supervisory authorities or courts can help determine what level of access should be granted, ensuring a fair balance between clashing interests.  

Conclusion 

Case C-203/22 provides important guidance on the need for transparency in AI-driven decision-making processes while recognising the legitimate protection of trade secrets. Organisations must ensure their AI systems are not only accurate, but also explainable, transparent and fair. 

Trilateral’s Data Protection advisors and the Responsible AI team will assist your organisation to build procedures compliant with data protection requirements while promoting responsible AI. In addition, our Trilateral GRC Suite platform equips an organization with the essential tools to showcase a strong and flourishing culture centred around data protection and responsible AI. Please contact any member of Trilateral’s team if you would like to discuss our services. 

You can also read more insights from Trilateral Research by following us on LinkedIn.