On 16 March 2023, the Advocate General Priit Pikamäe from the Court of Justice of the European Union (CJEU) has issued his Opinion in the case C-634/21 (OQ vs Land Hessen, with the participation of SCHUFA Holding AG – currently available in Romanian), this being the first important CJEU case which interprets the provisions on the automated decisions under Art. 22 GDPR (Automated Decisions).
In this case, a private credit agency (Credit Agency) has provided to a credit institution (Institution) a score on a natural person, which constituted the reason for refusal to grant her the access to the credit.
Thus, according to the Opinion of Advocate General, the automated establishment (in this case, by the Credit Agency) of a probability value concerning the ability of a natural person to benefit of a loan represents an Automated Decision (taken by the Credit Agency), when such value is communicated to another entity (in this case, the Institution) which, based on a consistent practice, decisively relies on that value for its decision on establishing, implementing or terminating a contractual relationship with that person.
In this case, the referring court explained that, even if the decision of the Institution must not depend only on the scoring provided by the Credit Agency, normally this happens decisively. Thus, even if providing the loans by the Institution may be refused based on a sufficient credit score, an insufficient credit score would nearly always lead (in case of consumer loans) to a loan rejection, even when an investment seems to be otherwise profitable.
We have also extracted the following additional aspects from the Opinion of the Advocate General Priit Pikamäe:
1. Seriousness of the legal/similarly significant effects
According to the Opinion of the Advocate General, only the legal/similarly significant effects which have a serious impact are covered by Automated Decisions. Therefore, not any legal/similarly significant effect would trigger the application of Art. 22 GDPR.
2. Who provides the details on Automated Decision in case of access right
Under Art. 15 paragraph 1 letter (h) GDPR, the natural person has the right to obtain, on the basis of access right, amongst others, information on Automated Decisions taken in his/her respect (if any), including:
- the existence of the Automated Decision;
- meaningful information on the logic involved in this case, and
- meaningful information on the significance and the envisaged consequences of such an Automated Decision.
From the Opinion of the Advocate General Priit Pikamäe it seems to result that the Institution will not be obliged to provide the aforesaid information under Art. 15 paragraph 1 letter (h) GPDR on the Automated Decision taken by the Credit Agency, because the Institution does not hold this information.
3. What is “meaningful information about the logic involved”
The Advocate General Priit Pikamäe had the following position on “meaningful information about the logic involved”:
- this information shall include sufficient detailed explanation on (i) the method used for the calculation of credit scoring (or, respectively, of other values on which the Automated Decision relies) and (ii) the causes which led to a specific result;
- the details shall comprise general information on (i) the factors taken into consideration for the Automated Decision and (ii) the importance of each of such factors in an aggregated manner, such information being useful to the natural person for contesting the the Automated Decision;
- there is no need to provide the algorithm considering its complexity, since providing a complex formula is useless without an explanation;
- the controller may omit to provide certain information if there are conflicting interests worth of protection (e.g., trade secrets, copyright, software protection), but this omission shall not have as a result the refusal to provide all such information; a minimal information must be still provided.
4. National provisions on Automated Decisions
It is not contrary to GDPR the situation in which a EU Member State has certain national regulations which set other types of automated decisions than those under Art. 22 GDPR (the example of Germany). However, even in this case, such decisions must observe the conditions on setting a legal ground according to Art. 6 GDPR.
In most cases, the Opinions of the Advocate General are adopted by the judges of the CJEU. It is to be seen if the judgement of the Court in the case C-634/21 will also be in line with the position of the Advocate General Priit Pikamäe.
