On 7 April 2021, the data subject requested access to their data under Article 15 GDPR

Decision Date November 17, 2025 Legal Norm Federal Constitutional Law (B-VG) Art. 133 para. 4 GDPR Art. 12 GDPR Art. 14 GDPR Art. 15 GDPR Art. 22 para. 1 GDPR Art. 4 no. 1 GDPR Art. 4 no. 4 Federal Constitutional Law (B-VG) Art. 133 currently in force; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from Article 133 of the Federal Constitutional Law (B-VG) valid from 1 August 2014 to 24 May 2018, last amended by Federal Law Gazette I No. 164/2013; Article 133 valid from 1 January 2014 to 31 July 2014, last amended by Federal Law Gazette I No.

51/2012; Article 133 valid from 1 January 2004 to 31 December 2013, last amended by Federal Law Gazette I No. 100/2003; Article 133 valid from 1 January 1975 to 31 December 2003, last amended by Federal Law Gazette No. 444/1974; Article 133 valid from 25 December 1946 to 31 December 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946, last amended by Federal Law Gazette No. 4/1945. B-VG Art. 133 valid from January 3, 1930 to June 30, 1934. Ruling W254 2253353-1/26E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, composed of Judge Dr. Tatjana Cardona as presiding judge, and lay judges Mag. Viktoria Haidinger and Mag. Thomas Gschaar as associate judges, renders the following judgment on the appeal of XXXX, represented by Baker McKenzie Rechtsanwälte LLP & Co KG, against points 1 and 2 of the decision of the Data Protection Authority dated January 3, 2022, file number XXXX (intervening party: XXXX, represented by attorney Mag.

), concerning a data protection matter, after conducting an oral hearing: The Federal Administrative Court, composed of Judge Dr. Tatjana Cardona as presiding judge, and lay judges Mag. Viktoria Haidinger and Mag. ), concerning a data protection matter, after conducting an oral hearing, decides as follows: A) The appeal is dismissed as unfounded. B) Revision is not permitted pursuant to Article 133, paragraph 4, of the Austrian Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Procedural History: Procedural History: 1. The party now involved in the proceedings requested, for the first time by email dated April 7, 2021, information pursuant to Article 15 of the GDPR regarding its personal data stored by the complaining party. The complaining party subsequently provided this information by letter dated April 12, 2021. 2. By email dated May 19, 2021, the party involved objected to the incompleteness of this information and requested its completion.

In accordance with this request, the complainant provided the co-respondent with supplementary information by letter dated May 27, 2021. 3. By letter dated July 13, 2021, the co-respondent filed a data protection complaint with the Data Protection Authority (hereinafter: the respondent authority), arguing essentially that the information provided to the co-respondent, consisting of first and last name, date of birth, and address, was incomplete, as the complainant's privacy policy listed significantly more data categories that were processed and the information provided did not include any corresponding negative entries. The information regarding the origin of the processed personal data was also incomplete. 4. In the course of the administrative proceedings, the complainant provided further supplementary information by letter dated August 19, 2021. 5. The complaining party responded by letter of the same date, stating, with regard to the complaint, that it processes the following personal data of the co-defendant: name, date of birth, address, job title, and calculated credit ratings.

The privacy policy lists all data categories that the complaining party could theoretically process. However, the complaining party does not process any other data categories with regard to the co-defendant. Since no payment history data is available for the co-defendant, no such data is processed. Furthermore, changes to the credit rating can result from other, non-personal statistical criteria, which are subject to change depending on economic developments. The privacy policy lists all data categories that the complaining party could theoretically process. 6. In its statement of September 9, 2021, the co-respondent essentially objected to the incompleteness of the information provided by the appellant regarding the personal data processed by the co-respondent and the origin of that data, with respect to the present appeal. 7. By decision of January 3, 2022, the respondent authority partially upheld the appeal and found a violation of the right of access, as the appellant had failed to provide information pursuant to Article 15(1)(h) GDPR until the conclusion of the administrative proceedings (Point 1).

The appellant was ordered to provide the co-respondent with the information specified in Point 1 (Point 2). The appeal was otherwise dismissed (Point 3). By decision dated January 3, 2022, the respondent authority partially upheld the appeal and found a violation of the right to information, as the appellant had failed to provide information pursuant to Article 15(1)(h) GDPR until the conclusion of the administrative proceedings (Point 1). The appellant was ordered to provide the co-respondent with information to the extent specified in Point 1 (Point 2). The appeal was otherwise dismissed (Point 3). In its reasoning for Points 1 and 2, the respondent authority essentially stated that the calculation of the credit rating constituted profiling within the meaning of Article 4(4) GDPR and that, due to the explicit mention of profiling in Article 15(1)(h) GDPR, the appellant was subject to an obligation to provide information pursuant to Article 15(1)(h) GDPR.

The complainant could also provide the co-defendant with further information regarding the calculation of the credit rating without disclosing its trade secrets. In its reasoning for points 1 and 2, the respondent authority essentially stated that the calculation of the credit rating constitutes profiling within the meaning of Article 4(4) GDPR and that, due to the explicit mention of profiling in Article 15(1)(h) GDPR, the complainant was subject to an obligation to provide information pursuant to Article 15(1)(h) GDPR. The complainant could also provide the co-defendant with further information regarding the calculation of the credit rating without disclosing its trade secrets. 8. The complainant filed a timely appeal against points 1 and 2 of the respondent authority's decision by letter dated February 9, 2022. The complaint essentially argued that it was unclear what information the complainant was still required to disclose and where the line should be drawn regarding protected trade secrets; furthermore, that no decision based on automated processing existed, and therefore the complainant was not subject to the obligation to provide information under Article 15(1)(h) GDPR; moreover, the complainant's calculation of creditworthiness was not a decision in this sense, nor did the calculation have legal effect within the meaning of Article 22(1) GDPR or similarly significantly affect the other party involved; and finally, in any case, the ground for refusal of disclosure based on trade secrets would preclude the right to information.

The complainant filed a timely appeal against points 1 and 2 of the respondent authority's decision by letter dated February 9, 2022. The complaint essentially argued that it was unclear what information the complainant was still obligated to disclose and where the line should be drawn regarding protected trade secrets; furthermore, that no decision based on automated processing existed, and therefore the complainant was not subject to the obligation to provide information under Article 15(1)(h) GDPR; moreover, that the complainant's calculation of creditworthiness was not a decision in this sense, nor did the calculation have legal effect within the meaning of Article 22(1) GDPR, nor did it similarly significantly affect the other party; and finally, that in any case, the ground for refusal based on trade secrets precluded the right to information. 9. The complaint and the related administrative act were submitted by the respondent authority by letter dated March 28, 2022, and were received by the Federal Administrative Court on March 29, 2022.

13. By decision of the Court of 17 April 2024, the present proceedings were stayed pending a preliminary ruling by the Court of Justice of the European Union in Case C-203/22. 13. By letter dated 15 May 2025, the Federal Administrative Court informed the appellant that the proceedings were continuing pursuant to the judgment of the CJEU of 27 February 2025 in Case C-203/22 and, on that basis, requested the appellant to provide the court, within two weeks of service, with meaningful information on the logic involved in the automated decision-making process, in a precise, transparent and intelligible form, and in particular: all relevant information, including explanations of the procedure and the principles of automated processing; all information that makes it possible to verify the accuracy and lawfulness of the automated decision-making; explanations of how the mechanism works and the outcome; the considerations or criteria underlying the decision-making and their weighting; which personal data were used in the automated decision-making process and how; and an explanation of why the party involved was assigned a particular assessment result.

If any of this information should be subject to trade secrets, the complainant was advised to submit it nonetheless, clearly marked as such, and to explain the legitimate interest in maintaining confidentiality. 14. In response to this request, the complainant stated in its submission of May 30, 2025, that the credit score it generates does not constitute automated decision-making within the meaning of Article 22(1) GDPR, as it is not relevant for its customers' decisions regarding the establishment of a contractual relationship with the other party involved. Consequently, based on the CJEU rulings in cases C-203/22 and C-634/21, it is not subject to any obligation to provide information under Article 15(1)(h) GDPR. Disclosure of trade secrets would only be required if an automated decision in an individual case within the meaning of Article 22(1) GDPR were involved, which is not the case.

Such an intervention would also be disproportionate and should in any case be examined within the framework of evidentiary proceedings. 14. In response to this request, the complainant stated in its submission of 30 May 2025, in essence, that the credit score it generated did not constitute automated decision-making within the meaning of Article 22(1) GDPR, as it was not relevant for its customers' decisions regarding the establishment of a contractual relationship with the other party involved. Consequently, based on the judgments of the CJEU in cases C-203/22 and C-634/21, it was not subject to any obligation to provide information under Article 15(1)(h) GDPR. Disclosure of trade secrets is only required if an automated decision-making process within the meaning of Article 22(1) GDPR were involved, which is not the case. Such an intrusion would also be disproportionate and must, in any event, be examined within the framework of an evidentiary hearing.

The appellant nevertheless provided further information on the calculation of the credit score on a non-prejudicial basis and requested that the proceedings be discontinued. 15. On September 17, 2025, a public oral hearing was held at the Federal Administrative Court, during which both an informed representative of the appellant and a witness were heard, and the parties were given the opportunity to ask questions of the persons heard, to submit further evidence, and to present their positions. ``` 16. Following the oral hearing, both the appellant and the intervener submitted written statements, in which they resubmitted, in particular, the documents already presented at the oral hearing. II. The Federal Administrative Court considered the following: 1. 1. By email dated April 7, 2021, the intervener requested information from the appellant pursuant to Article 15 GDPR. 1. By email dated April 7, 2021, the intervener requested information from the appellant pursuant to Article 15 GDPR.

The complainant party subsequently informed the co-respondent party by letter dated April 12, 2021, of the personal data concerning it that had been stored for the previous six months, namely name, date of birth, address, and business function, as well as the origin of this data and the information that no partner company had requested the credit score during this period. By letter dated May 27, 2021, the complainant party provided the co-respondent party with supplementary information, completing the table with all partner companies that had requested the co-respondent party's identity or creditworthiness for the period from 2014 to 2021 and the credit scores transmitted to them. By letter dated May 27, 2021, the complainant party provided the co-respondent party with supplementary information, completing the table with all partner companies that had requested the co-respondent party's identity or creditworthiness for the period from 2014 to 2021 and the credit scores transmitted to them.

Roman numeral 40 . Roman numeral 40 (XXXX) 450 - 474 April 29, 2019 Roman numeral 40 (XXXX) Roman numeral 40 (XXXX) Roman numeral 40 (XXXX) 450 - 474 April 18, 2019 Roman numeral 40 (XXXX) Roman numeral 40 (XXXX) April 10, 2019 Roman numeral 40 (XXXX) Roman numeral 40 (XXXX) Roman numeral 40 (XXXX) 475 - 499 January 19, 2018 Roman numeral 40 (XXXX) Roman numeral 40 (XXXX) 450 - 474 January 24, 2018 Roman numeral 40 (XXXX) 40 Roman numerals (XXXX) 100 January 3, 2017 40 Roman numerals (XXXX) 40 Roman numerals (XXXX) January 6, 2017 40 Roman numerals (XXXX) 40 Roman numerals (XXXX) 40 Roman numerals (XXXX) 450 - 474 January 19, 2016 40 Roman numerals (XXXX) 40 Roman numerals (XXXX) January 25, 2015 40 Roman numerals (XXXX) 40 Roman numerals (XXXX) 450 - 474 By letter dated October 20, 2023, the complaining party provided the co-defendant with further information in tabular form regarding this stored personal data, as well as further information about the credit rating and its calculation.

Accordingly, the credit rating is calculated using the following personal data of the data subject: payment history, name, age, gender, address, and the first and last confirmation of the address. In a submission dated May 30, 2025, the complaining party provided the co-defendant with further information about the credit rating and its calculation. The complaining party calculates two ranges with values from 0 to 100 and 250 to 700. The former considers only negative payment history, with a value of 100 being assigned if no such history is recorded. The latter is calculated using the following factors: age, gender, address, name, and payment history. Furthermore, statistical parameters dependent on overall economic developments are also incorporated into the credit rating calculation. The age factor has an impact insofar as older individuals have a higher credit rating than younger individuals.

Regarding the gender factor, women have a lower probability of default than men. Regarding address and name, a comparison is made between the creditworthiness criteria of individuals with identical addresses and surnames, taking into account whether payment defaults occur more or less frequently at a particular address. With respect to payment history data, older payment experiences negatively impact the credit score less than more recent ones, and their absence has a positive effect. The aforementioned factors are correlated using a mathematical formula to calculate a statistical probability of default. A score of 250 indicates insolvency. 3% of all individuals have a score above 650. /24) detailing which personal data was stored as of September 15, 2025. A key was provided to explain the credit rating of an individual in abstract terms. 2. On April 14, 2019, the mail-order company XXXX (now: XXXX) queried the credit rating of the co-involved party in the complaining party's database.

/N) remained unchallenged. Ultimately, the informed representative stated, in accordance with this assessment, that the price could be between €2 and €5, but that some products are considerably more expensive (transcript, p. 6). The price of the credit check is based on the oral complaint hearing (transcript, p. 6) and the submitted evidence (Pricing Inquiry [Exhibit N2] and Roman numeral 40 [Exhibit N]). /N) remained unchallenged. Ultimately, the informed representative stated, consistent with this assessment, that the price could be between €2 and €5, but that there are also products that cost significantly more (Transcript of the Hearing, p. 6). The informed representative also seemed unwilling to answer the question regarding the frequency of credit score inquiries, citing a lack of knowledge (VR: Can you tell me, for example, how many inquiries does XXXX Bank make annually with XXXX?

P: Unfortunately, that is beyond my knowledge. Transcript of the Hearing, p. 6). /O and the transcript of the hearing, p. 23) and is not disputed (see the co-litigant's submissions, transcript of the hearing, p. 23). The informed representative also seemed unwilling to answer the question regarding the frequency of credit score inquiries, citing a lack of knowledge (VR: Can you tell me, for example, how many inquiries the Roman 40 Bank makes annually with Roman 40? P: Unfortunately, that is beyond my knowledge. Transcript of the hearing, p. 6). /O and the transcript of the hearing, p. 23) and is not disputed (see the co-litigant's submissions and the transcript of the hearing, p. 23). That the score formula is always calculated in the same way, but that there are also customers who order specific score models, is evident from the undisputed statement of the informed representative during the oral appeal hearing (see the transcript of the hearing, p.

10). The score formula is always calculated in the same way, but that there are also customers who order specific score models, is evident from the undisputed statement of the informed representative during the oral appeal hearing (see the transcript of the hearing, p. 10). /17). It is also undisputed that credit scores are generally used. For example, the statements of the informed representative of the complaining party indicate that the score value (Minutes of the Meeting, p. 7) is used by customers as a decision-making aid. However, the question of the significance of the calculated credit scores in the companies' subsequent procedures is disputed. That these credit scores represent a decisive factor for the subsequent procedures with the end customer is evident from the following considerations: Creditworthiness provides information about the likelihood that a customer will meet their payment obligations.

If a credit check reveals that an end customer has poor credit, the company will generally not conclude a contract – even though it is possible in individual cases (see the minutes of the hearing, pp. 21f). The witness questioned also acknowledges that, with small loans of around €200, it is probably not possible to offset negative entries. Furthermore, the Federal Administrative Court agrees with the argument that the inquiry fee significantly reduces profits, and for this reason, a credit score is only requested when it is crucial for the conclusion or non-conclusion of a contract. The question posed to the informed representative of the complaining party as to why customers pay for a credit score that is not decisive ultimately remained unanswered. Initially, the representative gave an evasive answer, stating that the decision ultimately rests with the customer. Upon further questioning, the informed representative elaborated further, only to explain that there are several decision parameters.

The client then decides, based on their internal parameters, whether to complete the transaction and under what conditions. In the case of a Customers – I've looked into this – consider, for example, 11 decision parameters when making their decisions. ”). The Federal Administrative Court does not overlook the fact that the appellant argues that the score is only one of many parameters considered by customers and is not the primary factor in their decision-making. The Federal Administrative Court does not accept this argument in its general form: the informed representative of the appellant, in contradiction to this assertion, stated during the oral hearing that the appellant even returns a score value when they have no data on a person, so that the process can continue (transcript of the hearing, pp. 10f). This statement alone demonstrates the crucial importance of credit scores in the companies' decision-making process.

) and the fees charged for these inquiries clearly indicate (as already explained above) that credit scores represent a decisive factor. , for new customers) with which to conduct internal scoring, which is why they must rely even more heavily on the score calculated by the appellant. The Federal Administrative Court does not accept this argument in its general form: the informed representative of the appellant, in contradiction to this assertion, stated during the oral hearing that the appellant even provides a score value when they have no data on a person, so that the process can continue (transcript of the hearing, pp. 10f). This statement alone demonstrates the crucial importance of credit scores in the companies' decision-making process. ) and the fees charged for these inquiries clearly show (as already explained above) that credit scores represent a decisive factor. , from new customers) with which to conduct internal scoring, which is why they must rely even more heavily on the score calculated by the complainant.

/17), these confirmations were drafted by the complainant itself following the ECJ's SCHUFA ruling and were signed by its customers with more or less identical wording. However, the oral hearing revealed that the complainant is not familiar with the internal processes of its customers in detail (transcript p. 11) and therefore a confirmation drafted and provided by the complainant, which is signed identically by its customers, cannot be considered particularly authoritative. This is all the more concerning given that the informed representative himself admitted during the oral appeal hearing that he did not know how the customers evaluated the scores (see above, transcript of hearing, p. 7). /17). However, these confirmations were drafted by the complaining party itself following the ECJ's SCHUFA ruling and were signed by its customers with more or less identical wording. The oral appeal hearing revealed, however, that the complaining party is not familiar with the internal processes of its customers in detail (transcript of hearing, p.

11), and therefore a confirmation drafted and provided by the complaining party and signed identically by its customers cannot be considered particularly authoritative. This is all the more surprising given that the informed representative himself admitted during the oral hearing that he did not know how customers evaluate the scores (see above, transcript of proceedings, p. 7). The witness requested by the co-litigant, an employee of a bank that, among other things, finances small loans, stated during the oral hearing that contractual relationships are not primarily dependent on the score value and that many factors are taken into account. /20), making this statement unsurprising. However, as explained above, this confirmation carries no particular evidentiary weight. It was indisputably initiated and formulated by the complainant in the aftermath of the ECJ ruling (SCHUFA C-634/21) (see transcript of proceedings, p.

These measures were indisputably initiated and formulated by the appellant party following the ECJ ruling (SCHUFA C-634/21) (see transcript of proceedings, p. 19) in order to postpone the consequences of this ruling or, as the co-defendant puts it, to "undo" it. Furthermore, it is not necessary for the credit score alone to determine whether a contract is concluded with the end customer; it is quite conceivable that other criteria also play a role. However, the particular importance of the credit score is not negated by the use of other criteria. " Even in such a case, the score would then be decisive in the sense of being the determining factor. In addition to the confirmations of the use of the credit score and the claim by the complaining party's customers (and thus also by the witness's testimony) that the scores were not decisive, the following should also be considered: The informed representative explained during the oral appeal hearing that, following the implementation of the SCHUFA ruling, they had contacted all customers to verify whether the score was being used significantly in the decision-making processes (hearing transcript, p.

transcript of proceedings, p. 13, RV2: You said that before these confirmations were signed, there was a coordination process. Were there customers who had to adjust internal processes to comply with the requirements of the ECJ ruling? P: As far as I know – always with regard to the use of our score – to my knowledge, no adjustment of the process was necessary. RV2: Nevertheless, according to you, there were inquiries from the legal departments as to whether and how the SCHUFA ruling should be implemented. And according to you, there was no need for changes? P: Yes. ) Regarding the confirmations of score usage and the assertion by the complainant's customers (and thus also by the witness's testimony) that the scores are not decisive, the following should also be noted in conclusion. To consider this: the informed representative explained in the oral appeal hearing that, following the implementation of the SCHUFA ruling, they had contacted all customers to verify whether the score was being used significantly in the decision-making processes (hearing transcript, p.

In cases of small loans or high-volume transactions, additional verification procedures that would be necessary after requesting credit scores are unrealistic. The fact that the complaining party failed to provide information on the weighting of the data categories used to calculate the credit rating—age, gender, address, name, payment history data, and macroeconomic statistical parameters—nor on the relevance of the macroeconomic statistical parameters until the conclusion of the proceedings, and failed to provide a sufficient, understandable, and comprehensible explanation as to why the co-defendant was assigned a particular rating, is evident from the case file (see also the section on Legal Assessment). ) 3. 1. Legal Basis: Union Law – GDPR Recitals 4, 11, 58, 63, and 71 of the GDPR state: (4) The processing of personal data should serve humanity. The right to the protection of personal data is not an absolute right; it must be viewed in light of its societal function and balanced against other fundamental rights in accordance with the principle of proportionality.

(…) (11) Effective protection of personal data throughout the Union requires strengthening and precisely defining the rights of data subjects and strengthening the obligations of those who process and decide on the processing of personal data, as well as – in the Member States – equal powers for monitoring and ensuring compliance with the rules on the protection of personal data, and equal sanctions in the event of a breach. (…) (58) The principle of transparency requires that information intended for the public or the data subject be precise, easily accessible and understandable, written in clear and plain language, and, where appropriate, supplemented with visual elements. … (…) (63) A data subject should have the right to access the personal data concerning him or her that has been collected and be able to exercise this right easily and at reasonable intervals in order to be aware of the processing and to verify its lawfulness.

(…) This right should not infringe upon the rights and freedoms of others, such as trade secrets or intellectual property rights, and in particular copyright in software. However, this must not result in the data subject being denied any information whatsoever. (…) (71) The data subject should have the right not to be subject to a decision – which may include a measure – based solely on automated processing relating to personal aspects concerning him or her which produces legal effects concerning him or her or similarly significantly affects him or her, such as the automatic rejection of an online loan application or online recruitment procedure without any human intervention. Such processing also includes ‘profiling’, which consists of any form of automated processing of personal data involving an evaluation of personal aspects relating to a natural person, in particular for the analysis or prediction of aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behavior, location or movements, insofar as this produces legal effects concerning the data subject or similarly significantly affects him or her.

… In any case, such processing should be accompanied by appropriate safeguards, including specific information for the data subject and the right to obtain direct human intervention, to express his or her point of view, to have the decision explained after an assessment, and the right to contest the decision. …“ Article 4(1)(1) and (4) GDPR – Definitions For the purposes of this Regulation, the following definitions apply: 1. ‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’); (…) 4. ) (g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. ) Article 15 GDPR – Right of access by the data subject (1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed; If this is the case, the data subject has the right to access these personal data and the following information: (…) (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

(…) (3) The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless otherwise requested by the data subject. (4) The right to obtain a copy referred to in paragraph 1(b) shall not adversely affect the rights and freedoms of others. Article 22(1) GDPR – Automated individual decision-making, including profiling (1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. ) (1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

(2) GDPR – Automated individual decision-making, including profiling (1) GDPR – Automated individual decision-making, including profiling (1) GDPR – Automated individual decision-making, including profiling (1) GDPR – Automated individual decision-making, including profiling ) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. 2016, p. 1, read as follows: “(35) ... ” Directive 95/46/EC of the European Parliament and of the Council (1). Therefore, this Directive should not affect the rights and obligations laid down in Directive 95/46/EC – in particular, the data subject’s right of access to their personal data that is being processed, as well as the right to rectification, erasure or restriction of processing of incomplete or inaccurate data, and, where applicable, the obligation to process sensitive data pursuant to Article 8(5) of Directive 95/46/EC.

1995, p. 31). 1995, p. 31). 23 November 1995, p. 31). Article 2 Definitions For the purposes of this Directive, the term 1. ‘trade secret’ means information that meets all of the following criteria: (a) it is secret in the sense that it is not generally known or readily accessible, either in its entirety or in the precise arrangement and combination of its components, to persons within the circles that normally deal with this type of information; (b) it has commercial value because it is secret; (c) it is subject to reasonable measures taken to keep it secret by the person who has lawful control over it; Article 9 Protection of the confidentiality of trade secrets in court proceedings (1) Member States shall ensure that the parties, their legal counsel or other representatives, court officials, witnesses, experts and all other persons involved in court proceedings concerning the unlawful acquisition, use or disclosure of a Persons who have access to documents that are part of such legal proceedings, or who have access to such documents, are not authorized to use or disclose a trade secret or alleged trade secret that has been classified as confidential by the competent courts on the basis of a duly reasoned application by an interested party and of which they have become aware through their participation in the proceedings or access to the documents.

Member States may also authorize the competent courts to take such measures ex officio. The obligation referred to in paragraph 1 continues to apply even after the conclusion of the court proceedings. However, the obligation ends if one of the following situations occurs: (a) a final judgment establishes that the alleged trade secret does not meet the criteria referred to in Article 2(1), or (b) over time, the information in question becomes generally known or readily accessible to persons within the circles that normally deal with that type of information. (2) Member States shall further ensure that, upon a duly reasoned request from a party, the competent courts may take specific measures necessary to safeguard the confidentiality of a trade secret or alleged trade secret used or referred to in the course of court proceedings relating to the unlawful acquisition, use, or disclosure of a trade secret.

(3) When deciding on measures pursuant to paragraph 2 and assessing their proportionality, the competent courts shall take into account the need to guarantee the right to an effective remedy and a fair trial, the legitimate interests of the parties and, where applicable, any third parties, and the potential harm that may result from granting or refusing such measures to one of the parties and, where applicable, any third parties. (4) Any processing of personal data pursuant to paragraphs 1, 2 or 3 shall be carried out in accordance with Directive 95/46/EC. 2. 1. Regarding the Requirements of Article 22 GDPR According to Article 15(1) GDPR, the data subject has the right, where personal data concerning him or her are being processed by the controller, to obtain information about such personal data. In addition, the data subject also has the right to access the information contained in Article 15(1)(a) to (h) GDPR.

As is evident from the data protection complaint of September 2, 2021, and the statement of November 22, 2021, submitted by the now-involved party, this party has, among other things, requested information pursuant to Article 15(1)(h) GDPR. The complaining party denies any obligation to provide such information. According to Article 15(1) GDPR, the data subject has the right, where personal data concerning him or her are being processed by the controller, to obtain information about such personal data. to obtain personal data. In addition, the data subject also has the right to access the information contained in Article 15(1), letters a to h, of the GDPR. As is evident from the data protection complaint of September 2, 2021, and the statement of November 22, 2021, submitted by the now-participating party, this party has requested, among other things, access pursuant to Article 15(1), letter h, of the GDPR.

The complaining party denies any obligation to provide such access. 2023, C-634/21, SCHUFA, para. 43). 2023, C-634/21, SCHUFA, para. 43). The initial question to be clarified is therefore whether the credit rating or score calculated by the complainant constitutes a decision within the meaning of Article 22(1) GDPR. In the aforementioned judgment, the CJEU held that the term "decision" within the meaning of Article 22(1) GDPR can encompass several actions that may affect the data subject in various ways, and that the term is thus broad enough to include the result of calculating a person's ability to meet future payment obligations in the form of a probability score (paragraphs 44-46). Therefore, the credit rating calculated by the complainant, which concerns a person's ability and willingness to pay, must also be considered a decision within the meaning of Article 22(1) GDPR. The first requirement is thus fulfilled.

In the aforementioned judgment on this issue, the CJEU held that the term "decision" within the meaning of Article 22(1) GDPR can encompass several actions that may affect the data subject in various ways, and that the term is therefore broad enough to include the result of calculating a person's ability to meet future payment obligations in the form of a probability score (paragraphs 44-46). Consequently, the credit rating calculated by the complainant, which concerns a person's ability and willingness to pay, must also be considered a decision within the meaning of Article 22(1) GDPR. The first requirement is thus fulfilled. This judgment therefore makes it clear that, contrary to the complainant's legal opinion, the existence of a decision within the meaning of Article 22(1) GDPR does not depend on the complainant's assessment of the credit rating. The fact that the complaining party merely generates the credit rating and does not itself evaluate this rating, but rather that the evaluation and thus the decision regarding the establishment of a business or contractual relationship only occurs in a second step, after the credit rating has been transmitted to inquiring customers by the customers themselves, does not preclude the applicability of Article 22(1) GDPR.

This ruling therefore clarifies that, contrary to the complaining party's legal opinion, the existence of a decision within the meaning of Article 22(1) GDPR does not depend on the complaining party's evaluation of the credit rating. The fact that the complaining party merely generates the credit rating and does not itself evaluate this rating, but rather that the evaluation and thus the decision regarding the establishment of a business or contractual relationship only occurs in a second step, after the credit rating has been transmitted to inquiring customers by the customers themselves, does not preclude the applicability of Article 22(1) GDPR. ∠ ... Secondly, the decision pursuant to Article 22(1) GDPR must be based solely on automated processing, including profiling. As can be seen from the information provided by the complainant on April 12, 2021, May 27, 2021, and August 19, 2021, the credit rating calculated by the complainant is based on personal data and allows conclusions to be drawn about the creditworthiness of the data subject.

Therefore, the complainant uses personal data within the framework of its scoring to evaluate certain aspects relating to natural persons, in particular to analyze or predict aspects concerning their financial situation, reliability, and likely behavior. The legal definition in Article 4(4) GDPR is therefore met, and the scoring carried out by the complainant constitutes profiling within the meaning of Article 4(4) GDPR. Since the complainant has also not disputed that its scoring constitutes profiling, the second requirement of Article 22(1) GDPR is also fulfilled (see also paragraph 47 of the SCHUFA judgment, C-634/21). As can be seen from the information provided by the complainant on April 12, 2021, May 27, 2021, and August 19, 2021, the credit rating generated by the complainant is calculated using personal data and allows conclusions to be drawn about the creditworthiness of the data subject.

The complainant therefore uses personal data in its scoring to evaluate certain aspects relating to natural persons, in particular to analyze or predict aspects concerning their economic situation, reliability, and likely behavior. The legal definition in Article 4(4) GDPR is thus met, and the scoring carried out by the complainant constitutes profiling within the meaning of Article 4(4) GDPR. Since the complainant has also not disputed that its scoring constitutes profiling, the second condition of Article 22(1) GDPR is also met (see also paragraph 47 of the SCHUFA judgment, C-634/21). Thirdly, the decision based solely on automated processing, including profiling, must produce legal effects concerning the data subject or similarly significantly affect them. As can be seen from the Advocate General's Opinion (paragraphs 34 and 35), the requirement of Article 22(1) GDPR, namely that the decision must produce legal effects or similarly significantly affect the data subject, is only met if it has serious consequences for the data subject.

Furthermore, reference is made to Recital 71 of the GDPR, which cites the automatic rejection of an online loan application as a typical example of a decision that significantly affects the data subject. Thirdly, the decision based solely on automated processing, including profiling, must produce legal effects concerning the data subject or similarly significantly affect them. The Advocate General's Opinion (paragraphs 34 and 35) already mentioned indicates that the requirement of Article 22(1) GDPR, namely the production of legal effects or similarly significant effects, is only met if the decision has a serious impact on the data subject. Furthermore, reference is made to Recital 71 of the GDPR, which cites the automatic rejection of an online loan application as a typical example of a decision that significantly affects the data subject. The fact that the credit score calculated by the complainant is transmitted to inquiring customers, who then use this score to decide whether to enter into a contractual relationship or, consequently, whether to grant a loan, constitutes a decision that can produce legal effects on the data subject within the meaning of the above or similarly significantly affect them.

The decisive factor is not whether a contractual relationship is (not) established, carried out or terminated on the basis of this credit rating, but merely whether the credit rating is relevant for this (cf. 2023, C-634/21, para. 73), so that it is not necessary that the party involved in the matter in question was actually adversely affected by the transmitted credit rating. Furthermore, the data subject also has a right vis-à-vis the credit agency to receive a hypothetical credit score calculation (Franck in Gola/Heckmann, GDPR3 Art. 15 para. 19; Bäcker in Kühling/Buchner, GDPR/BDSG4 Art. 15 para. 9). The fact that the credit rating calculated by the complaining party is transmitted to inquiring customers, and that these customers use this rating to decide whether to enter into a contractual relationship or whether to assess their creditworthiness and thus whether to enter into a loan agreement, constitutes a decision that can have legal effect on the data subject within the meaning of the above explanations or can similarly significantly affect them.

2023, C-634/21, para. 73), so that it is not necessary for the party involved in the matter in question to have actually been adversely affected by the transmitted credit rating. Furthermore, the data subject also has a right to receive a hypothetical credit score calculation from the credit agency (Franck in Gola/Heckmann, GDPR3 Article 15, para. 19; Bäcker in Kühling/Buchner, GDPR/BDSG4 Article 15, para. 9). ``` The objections of the appellant (see, for example, the brief dated May 30, 2025) that its credit scores are not relevant for its customers – the requesting companies – within the meaning of this case law, cannot cast doubt on this: as established and comprehensively explained in the evaluation of evidence, the credit score constitutes a decisive factor for the further procedure with the end customer (see point 2). If the credit score constitutes a decisive factor, then it is also relevant within the meaning of the ECJ case law.

The appellant's objections (see, for example, the brief dated May 30, 2025) that its credit scores are not relevant to its customers—the requesting companies—within the meaning of this case law cannot be refuted: as established and comprehensively explained in the evaluation of evidence, the credit score constitutes a decisive factor for the further procedure with the end customer (see point 2). If the credit score constitutes a decisive factor, then it is also relevant within the meaning of the CJEU case law. " This wording leaves no doubt that the credit score transmitted by the appellant is relevant for the decision-making of the aforementioned company. It should be noted in passing that the vehemence with which the underlying logic used to determine the credit rating is being concealed contradicts the narrative that the score is not of decisive importance. Therefore, all three conditions are cumulatively met, and the requirements of Article 22(1) GDPR are fulfilled.

Since the complainant, as already mentioned above, processes personal data of the co-involved party and uses this personal data for automated decision-making, including profiling, the complainant is also subject to an obligation to provide information pursuant to Article 15(1)(h) GDPR. Thus, all three conditions are cumulatively met, and the requirements of Article 22(1) GDPR are fulfilled. Since the complaining party, as already mentioned above, processes personal data of the co-participating party and uses this personal data for automated decision-making, including profiling, the complaining party is also subject to an obligation to provide information pursuant to Article 15(1)(h) GDPR in this case. Finally, it must also be clarified at this point that the consumer right to information, strengthened by recent CJEU case law, cannot be circumvented or undone in cases of automated decision-making or profiling by a unilateral interpretation or signing of confirmations, as in the present case, or by using additional parameters for concluding a contract.

2. Scope of the obligation to provide information pursuant to Article 15(1)(h) GDPR Regarding the scope of the obligation to provide information pursuant to Article 15(1)(h) GDPR According to the wording of Article 15(1)(h) GDPR, in addition to the existence of automated decision-making, including profiling, meaningful information about the logic involved, as well as the scope and intended effects of such processing for the data subject, must be provided. It is important to emphasize that "logic" does not refer to the specific algorithm consisting of the calculation formula, including weighting and calculation method, but merely to the principle on which the calculation of the credit score is based. Information about the logic must therefore include the parameters that allow the data subject to recognize which aspects of their person or behavior were used to calculate the credit score. The data subject does not need to be enabled to recalculate the credit score.

According to the wording of Article 15, paragraph 1, letter h, of the GDPR, in addition to the existence of automated decision-making, including profiling, meaningful information about the logic involved, as well as the scope and intended effects of such processing for the data subject, must be provided. It is important to emphasize that "logic" does not refer to the specific algorithm consisting of the calculation formula, including weighting and calculation method, but merely to the principle on which the credit score calculation is based. Information about the logic must therefore include the parameters that allow the data subject to recognize which aspects of their person or behavior were used to calculate the credit score. The data subject does not need to be enabled to recalculate the credit score. The Article 29 Working Party recommends the following components of the information provided: ● The categories of data that have been or will be used in profiling or automated decision-making, including their weighting; ● why these categories are considered relevant; ● how the profiles used in automated decision-making are created, including statistics used in the analysis; ● why this profile is relevant for automated decision-making and ● how it is used for a decision concerning the data subject (Haidinger in Knyrim, DatKomm Art.

15 GDPR para. at)). The CJEU also refers to these guidelines in its recent decision of 27 February 2025, C-203/22, as the context to be considered for the information to be disclosed (paragraph 45). In its letters of 12 April 2021, 27 May 2021, and 19 August 2021, as well as in its present appeal of 9 February 2022, the appellant initially provided only information about the credit rating itself and – with the exception of the macroeconomic statistical parameters – the personal data used for this purpose and their origin. In a letter dated 30 May 2023, it finally provided the co-respondent with further information about the credit rating calculation. In that letter, it explained the factors used to calculate the credit rating – namely age, gender, address and name, as well as payment history data – and their impact on the calculation. The complainant also stated that macroeconomic statistical parameters were included in the calculation, but did not elaborate on their content and impact.

The complainant did not provide the co-defendant with complete information as required by Article 15(1)(h) GDPR. , the impact, of the macroeconomic statistical parameters—unlike the factors age, gender, address, name, and payment experience data. The complainant also failed to disclose the weighting of all these categories in its calculation. The complainant did not provide the co-defendant with complete information as required by Article 15(1)(h) GDPR. , the impact, of the macroeconomic statistical parameters—unlike the factors age, gender, address, name, and payment experience data. The complainant also failed to disclose the weighting of all these categories in its calculation. Insofar as the complainant failed to provide sufficiently informative details about the logic involved, as well as the scope and intended effects of the automated decision-making for the other party involved, the complainant violated its obligation to provide information under Article 15(1)(h) GDPR.

The information provided must not be limited to general considerations but must relate specifically to the individual case of the data subject. According to the CJEU, information could also be provided in this context regarding “[…] the extent to which a deviation in the personal data considered would have led to a different result” (see CJEU C 203/22, para. 62). The information provided must not be limited to general considerations but must relate specifically to the individual case of the data subject. According to the CJEU, information could also be provided in this context regarding “[…] the extent to which a deviation in the personal data considered would have led to a different result” (see CJEU C 203/22, para. 62). […] the information provided must not be limited to general considerations but must relate specifically to the individual case of the data subject. The information provided so far by the complainant is – as the co-defendant correctly points out – too general and not specifically related to the co-defendant, meaning that the information does not comply with the requirements of Article 15(1)(h) GDPR, which have been specified by the cited case law of the CJEU, especially since only data categories or generally “statistical values” that were included in the calculation of the rating were disclosed, but not the specific data processed relating to the co-defendant, a concrete weighting of the different data included in the calculation of the rating was not described, and the influence and scope of the data were only outlined in a preliminary way [The age of the co-defendant had a positive effect insofar as older persons statistically have a higher creditworthiness than younger persons; Gender had an effect insofar as women statistically have a lower probability of default than men.

(See statement of April 29, 2025, OZ 7) which was communicated, but which does not provide a sufficiently precise and understandable explanation of the functioning of the automated decision-making mechanism to which this person was subjected and the result to which this decision led. The complainant also provides no information as to how a deviation in the personal data of the other party involved would have led to a different result. It also remains unclear how a different residential address would affect the calculation of the score. The information provided by the complainant cannot therefore be considered sufficiently transparent and comprehensible. The information provided so far by the complainant party is – as the co-litigant correctly points out – too general and not specifically related to the co-litigant party. Therefore, the information provided does not comply with the requirements of Article 15(1)(h) GDPR, which have been further specified by the cited case law of the CJEU.

This is particularly problematic because only data categories or, more generally, "statistical values" that were used in calculating the rating were disclosed, but not the specific data processed relating to the co-litigant party. Furthermore, the specific weighting of the different data used in calculating the rating was not described, and the influence and scope of the data were only outlined in a preliminary way. ] (See statement of April 29, 2025, OZ 7) which was communicated, but which does not provide a sufficiently precise and understandable explanation of how the automated decision-making mechanism to which this person was subjected functions and the result to which this decision led. The complainant also provides no information as to how a deviation in the personal data of the co-defendant would have led to a different result. It also remains unclear how a different residential address would affect the calculation of the score.

The information provided by the complainant cannot therefore be considered sufficiently transparent and comprehensible. In summary, the complainant must specifically explain which personal data of the co-defendant was used in the automated decision-making process in question, how it was used, and how the co-defendant's assessment result was specifically arrived at. The complainant would have to, in the words of the CJEU in the aforementioned judgment (C-203/22), explain in a precise, transparent, intelligible and easily accessible form the procedure and principles on which the actual profiling (here the scores 500-549, 550-574 and 575-599) was based in order for its disclosure to comply with the requirements of Article 15(1)(h) GDPR. In particular, as has already been noted several times, information on the weighting of the data categories used to calculate the credit rating – age, gender, address, name, payment history data and macroeconomic statistical parameters – as well as information on the relevance of the macroeconomic statistical parameters, is missing.

The complainant has not provided a sufficient, comprehensible, and understandable explanation as to why the other party was assigned a particular rating. In summary, the complainant must specifically describe which personal data of the other party was used in the automated decision-making process in question, how it was used, and how the other party's rating was specifically determined. In the words of the CJEU in the aforementioned judgment (C-203/22), the complainant must explain, in a precise, transparent, intelligible, and easily accessible manner, the procedure and principles on which the actual profiling (here, the scores 500-549, 550-574, and 575-599) was based in order for its disclosure to comply with the requirements of Article 15(1)(h) of the GDPR. In particular, as has already been stated repeatedly, information is lacking regarding the weighting of the data categories used to calculate the credit rating – age, gender, address, name, payment history data, and macroeconomic statistical parameters – as well as information on the relevance of the macroeconomic statistical parameters.

Against this background, the Federal Administrative Court cannot find, in the present case, that the restriction of the scope of the right of access guaranteed to the co-defendant under Article 15(1)(h) GDPR, as ultimately sought by the appellant, constitutes a necessary and proportionate measure. Moreover, the CJEU held in its judgment of 27 February 2025, C-203/22, that even the existence of trade secrets must not lead to the data subject being denied any access to information whatsoever. Against this background, the Federal Administrative Court cannot find, in the present case, that the restriction of the scope of the right of access guaranteed to the co-defendant under Article 15(1)(h) GDPR, as ultimately sought by the appellant, constitutes a necessary and proportionate measure. Furthermore, in its judgment of 27 February 2025, C-203/22, the CJEU held that even the existence of trade secrets must not lead to the data subject being denied any information whatsoever.

However, it should be emphasized that it is not necessary for the complainant to disclose the algorithm used to calculate the credit rating. It is also not disputed that the calculation method developed by the complainant and used to determine the "score" constitutes a trade secret within the meaning of Article 2(1) of Directive 2016/943. However, it should be emphasized that it is not necessary for the complainant to disclose the algorithm used to calculate the credit rating. It is also not disputed that the calculation method developed by the complainant and used to determine the "score" constitutes a trade secret within the meaning of Article 2(1) of Directive 2016/943. 01, pp. 23-24, 28-29). Therefore, the right of access under Article 15(1)(h) GDPR carries particular weight with regard to the exercise of the data subject's rights. Accordingly, the mere indication of a potential risk to a trade secret cannot lead to a situation where the nature of the automated processing remains unclear to the data subject – as in the present case – and where a review of the procedure and the principles of the automated processing for the purpose of exercising their rights under the GDPR is substantially impossible.

01, pp. ). In this respect, the right of access under Article 15(1)(h) GDPR is of particular importance with regard to the exercise of the data subject's rights. Accordingly, the mere indication of a potential risk to a trade secret cannot lead to a situation where the nature of the automated processing remains unclear to the data subject—as in the present case—and where they are essentially prevented from reviewing the procedure and principles of the automated processing in order to exercise their rights under the GDPR. In the present case, the complainant, in fulfillment of their obligation to provide information pursuant to Article 15(1)(h) GDPR, as explained above, must explain to the co-respondent the nature of the automated processing of their personal data, specifically regarding the significance of the processed personal data for the co-respondent's calculated score, in order to guarantee their ability to exercise their rights, in particular those under Article 22(3) GDPR.

2025, C-203/22, Dun & Bradstreet Austria, para. 2025, Ro 2020/04/0010-13, paras. ). In the present case, the complainant, in fulfillment of its obligation to provide information pursuant to Article 15(1)(h) GDPR, as explained above, must explain to the co-respondent the manner in which the personal data of the co-respondent is processed automatically, specifically with regard to the significance of the processed personal data for the "score" calculated for the co-respondent, in order to guarantee the co-respondent the exercise of its rights, in particular those under Article 22(3) GDPR. 2025, C-203/22, Dun & Bradstreet Austria, para. 2025, Ro 2020/04/0010-13, paras. ). However, given the scope of the necessary explanations regarding the manner in which the personal data of the co-participants are processed automatically, it is not apparent that this necessarily discloses the trade secret concerning the general calculation method ("score formula") claimed by the appellant (see again Ro 2020/04/0010-13, paragraph 35).

4. Finally, it must be expressly stated here, in accordance with the data protection authority, that a situation in which the data of the participating party is used for a data-based business model, but at the same time is completely denied essential data protection rights of data subjects, such as the right of access under Article 15(1)(h) GDPR, is not compatible with the primary legal protection of personal data under Article 8(1) of the EU Charter of Fundamental Rights. 4. Finally, it must be expressly stated here, in accordance with the data protection authority, that a situation in which the data of the participating party is used for a data-based business model, but at the same time is completely denied essential data protection rights of data subjects, such as the right of access under Article 15(1)(h) GDPR, is not compatible with the primary legal protection of personal data under Article 8(1) of the EU Charter of Fundamental Rights.

† ... In accordance with the decisions of the CJEU (CJEU 634/21 of 7 December 2023 and C-203/22 of 27 February 2025), which aim to strengthen the legal position of consumers and reinforce the requirements for transparency and traceability in the handling of personal data, and the decision of the Austrian Administrative Court (VwGH) of 20 August 2025, Ro 2020/14/0010, which also emphasizes the serious consequences of automated processing of personal data for the purpose of creating a credit profile, the decision was rendered accordingly. Furthermore, the Constitutional Court recently rejected the complaint in a similar case (Case No. W108 2230691-1/53E, VfGH of 12 September 2025, E 1924/2025-16). Regarding point B) Inadmissibility of the appeal: The appeal is inadmissible pursuant to Article 133(4) of the Austrian Federal Constitutional Law (B-VG) because two decisions of the European Court of Justice (ECJ) (ECJ 634/21 and C-203/22) have already been issued and formed the basis of this decision.

The question of whether the credit score has legal effect on the data subject or similarly significantly affects them, and is therefore relevant within the meaning of ECJ case law, was answered in a case-by-case assessment based on the criteria of ECJ case law. Furthermore, the Austrian Administrative Court (VwGH) also addressed a comparable case in its recent decision of August 20, 2025, Ro 2020/14/0010. The Federal Administrative Court's decision is in accordance with the case law of the Administrative Court. There are also no other indications of the fundamental importance of the legal question to be resolved. The appeal is inadmissible pursuant to Article 133, paragraph 4, of the Austrian Federal Constitutional Law (B-VG) because two decisions of the European Court of Justice (ECJ) (ECJ 634/21 and C-203/22) have already been issued and formed the basis of the decision regarding the interpretation of the applicable provisions of the GDPR.

The question of whether the credit score has legal effect on the data subject or similarly significantly affects them, and is therefore relevant within the meaning of ECJ case law, was answered in a case-by-case assessment based on the criteria established by ECJ case law. Furthermore, the Austrian Administrative Court (VwGH) also addressed a comparable case in its recent decision of August 20, 2025, Ro 2020/14/0010. The Federal Administrative Court's decision is in accordance with the case law of the Administrative Court. There are also no other indications of the fundamental importance of the legal question to be resolved.