As AI systems make more decisions about credit, jobs, education and healthcare, the GDPR’s promise of “meaningful information” about automated decisions matters more and more. This article looks at what the term actually requires, what the CJEU clarified in Dun & Bradstreet Austria, and why meaningfulness should be judged from the affected person’s point of view rather than the developer’s.
An article by Aytaj Almmamadova
Imagine that you apply for a job and your application is assessed by an automated recruitment system. Shortly afterwards, you receive the following response:
“Your application did not meet the required criteria.”
At first sight, this sentence seems clear. It tells you the result: your application has been rejected. But is it meaningful?
Can the applicant find answers to questions such as which requirement the application failed to meet, and whether the decision was fair or whether the selected candidate met all the requirements? Or can the applicant change the decision by submitting additional evidence, or how can this decision be challenged?
It is challenging to answer the applicant’s questions based on the employer’s answer above.
But what if the applicant received a different answer?
“Your application was automatically rejected because our recruitment system identified two years of relevant professional experience in your CV, whereas the position requires at least three years. The system calculated your experience based on the employment dates provided in your application. If you believe this assessment is incorrect, you may request a human review.”
This simple example shows the concern behind Article 15(1)(h) GDPR. Information is not meaningful merely because it is disclosed, but because it lets the affected person understand how a decision was reached and whether they have grounds to question it. Therefore, the meaning of information is directly linked to the affected person’s ability to understand the decision, to identify the problem, and, in the GDPR context, to exercise relevant rights in practice.
The assessment of what constitutes “meaningful information” is more problematic, especially in AI decision-making processes where decisions are made by AI systems without any human intervention. Today, AI systems are used in decisions about creditworthiness, employment, education, healthcare, and other sectors that can significantly affect individuals, but the explanation provided to the affected person may still be general, technical, or of no real use.
But how does the law address this need for meaningful information? Article 15(1)(h) of the GDPR provides an important starting point.
Article 15(1)(h) of the GDPR: meaningful information as part of the right of access
The GDPR gives data subjects the right to obtain meaningful information in the case of automated decision-making. Under Article 15 of the GDPR, data subjects have the right to access their personal data and also to obtain certain information regarding the processing, including the purposes of the processing, the categories of personal data involved, the recipients of the data, the period for which it is stored, and the source of the data.
Article 15(1)(h) provides that the data subject has the right to receive “meaningful information about the logic involved”, as well as information about the significance and envisaged consequences of such processing, wherever automated decision-making is involved, including profiling, as referred to in Article 22(1) and 22(4).
Although Article 12(1) of the GDPR gives guidelines on how the information should be provided to the data subject, it does not specify which criteria make the information “meaningful”. It is unclear how much information should be given, what sort of information is needed, and from whose point of view meaningfulness should be evaluated.
Can one simply inform the person that an automated system had been used?
Is it enough to give a general description of the model?
Would a technical explanation of the algorithm be sufficient?
Or should the explanation be given in order that the person may come to understand the particular decision that has been made about him or her?
These questions are not only theoretical. They determine whether the right of access can become a practical means of enabling individuals to empower themselves, or whether it stays a formal right of limited value.
The clarification in Dun & Bradstreet Austria case
The European Court of Justice considered these questions in the Dun & Bradstreet Austria case. The case concerned automated credit assessment and a data subject’s right to obtain meaningful information about the logic involved in profiling, as provided for in Article 15(1)(h) of the GDPR.
The Court made it clear that this right does not require the controller to reveal the entire algorithm or to offer a highly complicated technical explanation. Specifically, the requirement cannot be met by supplying a complicated mathematical formula or a detailed technical description that the data subject could not realistically understand.
At the same time, the Court defined that the controller must explain the procedure and principles actually applied to the data subject’s personal data processing to reach the specific decision. The explanation must enable the data subjects to understand how and which of their personal data were used in the automated decision-making process to reach the specific decision about them.
Another important point of the relevant decision is examining profiling. The Court also said that, when it comes to profiling, it may be clear enough to tell the data subject how much a change in their personal data would have led to a different result. In simple terms, meaningful information may include an explanation of the main factors behind the result and whether changes to those factors could have led to a different result.
This clarification matters because it shifts attention from the system’s internal complexity to the affected person’s practical understanding. The question is not whether the controller has disclosed everything about the algorithm. The question is whether the person can understand how their data contributed to the result.
The Court also addressed the difficult issue of trade secrets and third-party data. If the controller argues that the requested information contains protected trade secrets or others’ personal data, this does not automatically justify refusing to provide the data subject with meaningful information. Instead, the controller must provide the allegedly protected information to the competent supervisory authority or to the court, which must then balance the competing rights and interests.
T his clarification also helps to avoid two extremes. On the one hand, data subjects cannot automatically demand full disclosure of every technical element of an automated system. On the other hand, controllers cannot use complexity, confidentiality, or trade secrets as a blanket justification for withholding a meaningful explanation.
Why does the problem still remain?
The Dun & Bradstreet Austria ruling matters because it provides important clarifications on the application of Article 15(1)(h) of the GDPR, but it does not solve all the problems. The idea of meaningful information remains difficult to apply, particularly in AI decision-making processes because for two main reasons.
First, the GDPR still provides no simple checklist defining exactly what type of information must be provided in every case. What counts as “meaningful” depends on the context, the type of decision, the automated system’s role, the personal data used, and the consequences for the individual. Therefore, meaningfulness should be assessed case by case.
Second, AI systems may be technically complex. Some systems operate in ways that are difficult to explain even for their developers. This is often described as the “black box” problem. However, technical complexity should not deprive legal rights of their practical effect. If a system is used to make decisions about individuals, the relevant legal standard requires that the affected person receive both an understandable and practically useful explanation.
Summary
Although the GDPR gives affected individuals the right to receive meaningful information about the logic involved in certain automated decision-making, it does not define the exact criteria of meaningfulness. The Dun & Bradstreet Austria judgment provides important guidance, but applying this right in practice remains difficult in AI decision-making processes.
Regarding all of the above, meaningful information should not be assessed mainly from the perspective of the controller or developer, or by reference solely to the system’s technical characteristics. Instead, it must be evaluated from the perspective of the individual affected by the decision. Therefore, information is meaningful to the individual insofar as it allows them to understand the role of automated processing, the main factors that led to the decision, and the various ways in which it can be challenged or responded to.
As AI systems are incorporated more and more into areas such as credit, employment, education, healthcare, and public administration, this issue will become all the more significant.
In this respect, meaningful information is a functional legal criterion that enables individuals to understand, question, and challenge decisions that affect their lives.
Published under licence CC BY-NC-ND.
