GDPR Could Trump EU Trade Secret Law in Some Cases, ECJ Rules
Businesses trying to limit information they would otherwise have to disclose under data protection laws but consider trade secrets could be forced to disclose those secrets to a court or arbitrator under a recent decision by the European Court of Justice (ECJ), Pinsent Masons attorneys noted Friday. The decision involves the interplay between General Data Protection Act provisions on automated decision-making and EU trade secrets law, they wrote.
Sign up for a free preview to unlock the rest of this article
The GDPR gives people the right to access personal data that controllers hold about them, along with "meaningful information about the logic involved where they've been subject to solely automated decision-making, along with the significance and expected consequences of such processing for them," the attorneys wrote.
The case involved a conflict between an Austrian consumer and the City Council of Vienna over an automated credit assessment. The assessment resulted in the consumer being denied a mobile contract, the ECJ ruling noted. The Austrian court asked the EU high court to clarify what "meaningful information about the logic involved" means in this context.
The court ruled that meaningful communications can't be satisfied by merely relaying a mathematical formula. Instead, it must be presented in a way the data subject understands, Pinsent Masons noted. In addition, when a data controller thinks information relating to an individual should be withheld under trade secret law, it must disclose that information to a court or regulator for a determination of whether that decision is correct.