An Algorithm Rejected You. Can You Ask Why?

A credit application is rejected before the applicant has finished wondering how long the decision will take. The explanation says a scoring system was used. That may identify the tool, but it does not necessarily explain the result. Which information mattered? Was any of it wrong? Was a person meaningfully involved? What can the applicant do next?

A 27 February 2025 judgment of the Court of Justice of the European Union addresses that gap. In Case C-203/22, Dun & Bradstreet Austria, the Court considered meaningful information about automated decision-making under EU data-protection law. The judgment does not promise access to every line of source code or a guaranteed reversal. It concerns information that makes the relevant decision intelligible and helps a person exercise their rights.

The jurisdiction is part of the answer

This article explains EU GDPR, using the actual Regulation (EU) 2016/679 text. It does not treat the CJEU judgment as a universal worldwide right or silently apply it to the UK's amended automated-decision framework. Similar words in different legal systems can have different rules and thresholds.

Article 15(1)(h) addresses information about the existence of relevant automated decision-making, including meaningful information about the logic involved and the significance and envisaged consequences. Article 22 concerns decisions based solely on automated processing that produce legal effects or similarly significantly affect a person. Those provisions are connected, but they are not a blanket demand for explanations of every recommendation or internal software calculation.

A suggested video in a feed is not automatically equivalent to a credit decision with significant consequences. A score used as one input is not automatically the whole decision. The actual process matters. This article's title therefore asks a question rather than assuming that every rejection engages the same legal protection.

What the Court wanted people to understand

The CJEU judgment considers how meaningful information can explain the procedure and principles actually applied. The aim is to enable the person to understand which personal data were used and how those data affected the result. That is a more useful standard than simply naming a model or stating that it is statistically sophisticated.

Imagine a hypothetical applicant asking why a scoring result contributed to a refusal. A generic answer lists broad categories of data used across the whole product. A more intelligible explanation connects the relevant procedure and factors to the person's result. This illustration is OLECH analysis, not a claim that a named lender's response has been held unlawful.

The judgment's focus also explains why handing over a complex formula may fail to answer the practical question. A technically detailed document can be unintelligible to its recipient. Conversely, an understandable account of the actual principles and data can be meaningful without reproducing every implementation detail. The point is not maximum technical volume; it is information that enables understanding and the exercise of rights.

Source code is not the default remedy

The Court does not create an automatic entitlement to a full technical blueprint. An explanation of the logic, data and consequences is different from demanding the complete model, all training materials or proprietary software. Those materials may contain information that is irrelevant to understanding the individual's result or that raises other protected interests.

That limitation is not permission to replace an explanation with boilerplate. “We use an algorithm” states that automation exists. It may say little about the actual procedure applied to the person. The EDPB's official account of a Berlin credit-rejection enforcement case illustrates concerns about blanket information detached from the individual case. That national case is supporting context, not the CJEU judgment itself.

The useful distinction is between intelligibility and exposure of every secret. A person needs enough meaningful information to understand and, where applicable, challenge the result. That does not automatically mean the person chooses the exact technical format or receives every document requested. The legal process balances the relevant rights and interests.

Trade secrets are not a complete explanation for silence

C-203/22 also addresses protected interests such as trade secrets and third-party personal data. The Court's reasoning does not allow a controller simply to invoke secrecy to refuse all meaningful information. Where the controller considers information protected, the relevant material can be provided to a competent supervisory authority or court for assessment and balancing.

That process matters because the applicant cannot independently decide what an unseen document contains, while the controller's assertion should not be the final word on every access question. The authority or court can assess the competing interests and determine what can be disclosed. This is not a promise that every disputed document becomes public or that protected third-party data must be handed to the applicant.

A hypothetical business might legitimately want to protect model details while still explaining the personal data and principles affecting a result. Those goals are not necessarily incompatible. The judgment makes the balancing exercise more important than a binary story in which either the entire model is exposed or the customer learns nothing.

Human involvement needs factual scrutiny

Article 22's threshold concerns a decision based solely on automated processing with the specified effects. Whether a real human role takes a process outside that description depends on what the person actually does. A nominal human step should not be assumed to settle the issue without examining its substance. Equally, an applicant should not assume there was no human involvement simply because the response arrived quickly.

The regulation includes exceptions and safeguards. Where the relevant framework applies, safeguards can include obtaining human intervention, expressing a point of view and contesting the decision. Those rights do not mean the reviewer is required to approve the application. An explanation can reveal a legitimate reason for refusal as well as an error or misunderstanding.

The legal significance of the decision also matters. A product recommendation, a preliminary estimate and a binding refusal can have different consequences. This article does not classify every algorithmic output as an Article 22 decision. It explains why the decision's role and effect should be established before invoking a particular safeguard.

A useful request asks about the actual process

A person seeking clarity can ask which controller is responsible, whether relevant automated decision-making was used, what personal data informed it and what meaningful information is available about the logic and consequences. They can also ask about the applicable review or challenge route. These are general editorial questions, not personalised legal advice or a guarantee about the response in a particular case.

If inaccurate personal data appear to have influenced the outcome, distinguishing the data issue from disagreement with the result can make the follow-up clearer. An incorrect address history and dissatisfaction with a lender's risk policy are different propositions. Both may deserve explanation, but they should not be compressed into a demand that an algorithm must say yes.

Keep the decision notice and the actual response. A short account of what is still unclear can be more useful than a broad demand for all technology documentation. Where a dispute persists, the appropriate regulator or qualified adviser can assess the facts and jurisdiction. This article does not promise that a complaint establishes a breach or produces approval.

“Why?” is not the same as “reverse it”

The important shift is from identifying automation to explaining a relevant automated process in a way the person can understand. The CJEU judgment supports meaningful information rather than a technical smokescreen or an automatic source-code dump. EU GDPR supplies scope, exceptions and safeguards that still need to be applied to the facts.

An algorithm's involvement does not make every refusal unlawful. Nor should it make the reasoning inaccessible merely because a system is complex. The realistic promise is a route to understanding and, where applicable, challenging a covered decision. Asking why can matter even when the eventual answer remains no.

Sources - CJEU C-203/22, full judgment, 27 February 2025 - EU GDPR official text: Articles 15 and 22 - EDPB official account of Berlin credit-rejection enforcement