On 27 February 2025, the CJEU ruled in the case of Dun & Bradstreet Austria (C-203/22): In the case of automated decisions within the meaning of Art. 22 GDPR, data subjects have a right to a comprehensible explanation of the procedures used and the outcome.
🔍 Key statements:
• Even complex “black box” systems do not exempt controllers from the duty to explain
• Trade secrets do not automatically override the right of access
• Counterfactual explanations can be helpful, for example: “If your monthly income had been €500 higher, you would have received the loan.”
💼 Relevance for HR practice:
Automated selection decisions are generally not permitted under data protection law in the HR context, unless a works agreement provides the necessary legal basis. Beyond that, the employer must be able to explain the decision — something many AI tools currently cannot do.
For more details, see the article by Tinhofer, ASoK 2025, 231.