In the decision of September 8, 2020, GZ: DSB-D124.909, 2020-0.436.002. the data protection authority had to deal with the scope of a right to information in the context of the so-called Geo_Milieus. Geo_Milieus are, in simple terms, classifications of people based on a probability calculation for the purpose of strategic marketing. Such classifications include “Probability_value_conservatives” (described as “Strongly influenced by Christian values, high regard for education and culture, critical of current social developments”) or “Probability_value_hedonists” (described as “The momentary, experience-hungry lower middle: living in the here and now, looking for fun and entertainment; refusing the conventions of mainstream society”).
The complainant had received information on the probability values assigned to him and the descriptions of the assigned Geo_Milieus, but no information on the basis of which parameters, for example. the “probability_value_conservative” for him was 2.03% and the probability_value_hedonist was 9.28%. The complainant therefore claimed that the information provided was incomplete, as the address publisher refused to provide more detailed information on the calculation of the values, citing company and business secrets.
The data protection authority first determined that the calculation and assignment of the Geo_Milieus probabilities constituted profiling pursuant to Art. 4 No. 4 of the GDPR, as aspects relating to the economic situation, personal preferences and interests of a data subject in particular were analyzed, segmented and related probability values were calculated in the course of automated processing.
Since Art. 15 para. 1 lit. h DSGVO provides that where automated decision-making, including profiling, exists pursuant to Art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved as well as the scope and the intended effects of such processing for the data subject must be provided, furthermore Art. 15 Par. 1 lit. h GDPR, the specific rights of access are not conclusively based on Art. 22 para. 1 and 4 of the GDPR, but wants to see these rights extended to other cases by the word “at least”, the data protection authority has to provide information on the establishment of the Geo_Milieus pursuant to Art. 12 Par. 1 in conjunction with 15 para. lit. h GDPR ordered. Only by providing information about the input variables, their weighting and an explanation of why a particular evaluation result is assigned to a data subject is it possible for data subjects to exercise their rights to rectification and deletion.
In contrast, business and trade secrets of the address publisher also take a back seat, as the rights to information and rectification, which have constitutional status (Section 1 (3) of the Data Protection Act) or are based on EU primary law (Article 8 of the EU Directive on the Protection of Human Rights and Fundamental Freedoms), are to be given greater weight and exceptions to the general provisions of the GDPR are to be interpreted narrowly (see ECJ C-311/18).
The request for disclosure of the complete calculation methodology – as also requested by the complainant – was, however, rejected. Art. 15 par. 1 lit. h GDPR only speaks of “meaningful information on the logic involved and its effects”, but not of the logic involved itself.
This decision is legally binding.