Information on the logic involved in automated credit scoring: easy, concise and free of technical jargon

Abstract

On 27 February 2025, the CJEU delivered its judgment in Dun & Bradstreet (Case C-203/2022), interpreting for the first time the scope of the data subject’s right to obtain “meaningful information about the logic involved” in automated individual decision-making [Art. 15(1)(h) GDPR], such as a credit score. This information must be comprehensible, accessible, and free of technical jargon, enabling the data subject to understand which personal data were used and how they influenced the outcome. The Court also held that data controllers cannot invoke trade secrecy to refuse access to such information. Although the judgment focuses on transparency obligations, it indirectly brings to light one of the most pressing risks of automated credit scoring: algorithmic discrimination. This article warns that sociodemographic data—such as place of residence—though statistically correlated with default risk, may not reflect an applicant’s actual creditworthiness and may lead to discriminatory outcomes. To prevent this, the article argues that automated credit scoring systems should rely exclusively on data that directly reflects the individual’s financial capacity to perform the contract.