Trade Secrecy Is a Limit on the Answer, Not a Reason to Give None

What Does an Explanation Have to Contain?

Under European data protection law, a description of the procedure and the principles actually applied to your data to reach your result. The Court of Justice of the EU said so in February 2025, deciding a case about automated credit scoring, and it required that description to be concise, transparent, intelligible and easy to get at ¹.

The provision behind it is Article 15(1)(h) of the GDPR, the access right, which covers the logic, the significance and the envisaged consequences for you ². Two limits travel with it. The right runs against the controller, meaning the employer or agency holding your data, rather than against the vendor whose software produced the output ². And it presupposes automated decision-making of the kind Article 22 describes, so a process with genuine human involvement may sit outside it altogether ¹.

What the Court withheld matters as much as what it granted. The ruling entitles nobody to the algorithm, the source code or the model weights ¹.

That gap decides which follow-up a stock refusal fits. A request phrased as send me the algorithm asks for the one thing the ruling keeps back, and a reply about proprietary technology fits it. A request phrased as tell me the procedure and the principles applied to my application asks for what the Court actually described.

The same reply no longer fits the question, and the rewording costs you a sentence.

The case was about credit scoring, and no hiring decision was before the Court ¹.

Where Does a Trade Secret Claim Take the Dispute?

To a supervisory authority or a court, rather than to a dead end. The Court held that a controller who calls the material a trade secret does not close the request by saying so. The disputed material goes to the authority or the court, which weighs the competing interests and decides what the person receives ¹.

That is still a real limit on what reaches you directly. The balancing happens somewhere you are not, on material you cannot see, and a regulator with a backlog is not a fast door. What changes is the shape of the conversation rather than the speed of it. An employer expecting a data protection authority to read the file has a reason to write a fuller answer than a stock refusal.

A trade secret refusal is a routing instruction, not a verdict.

A second European right reaches the employer as the user of the system rather than as the holder of your data. Article 86 of the EU AI Act covers a person affected by a decision taken on the output of an Annex III high-risk system. It applies where that decision carries legal effects or similarly significantly affects the person adversely, a threshold the Act does not define and a screening rejection may or may not meet ³.

The right is to clear and meaningful explanations of the system's role in the decision procedure and the main elements of the decision taken ³. It reaches the deployer, which in hiring is the employer, and it stops at the role and the main elements rather than the model.

The date is the honest caveat, and it moved recently.

A 2026 amendment pushed the AI Act's high-risk obligations for the Annex III category, which is where recruitment and selection systems sit, to 2 December 2027 ⁴.

What Can You Ask For in the United States?

Less than in Europe, and much of it arrives on a future date. No general right to an explanation of an automated hiring decision is in force across the country in 2026, so what you can ask for depends on where you applied from. Two rules are worth knowing by name, and neither one hands you the logic today.

New York City's Local Law 144 gives a written-request right, and it is narrow. Where the employer has not published the information on its website, you can ask in writing for three things, under the city's administrative code at 20-871(b)(3) ⁵. Those three are the type of data collected for the tool, the source of that data, and the employer's data retention policy, and the answer is due within 30 days ⁵. An explanation is not one of them.

The remedy sits with the city too. A violation carries a civil penalty of not more than $500 for a first violation and $500 to $1,500 for each one after that, recoverable by the city ⁶.

So a complaint there makes you a complainant, not a plaintiff.

Of the two, California's finalized rules on automated decisionmaking come closer to the European standard, and they bind from 1 January 2027. From that date a business using automated decisionmaking technology for a significant decision owes a plain-language answer to an access request, and the category expressly includes hiring ⁷. The answer has to cover the specific purpose, information about the logic, and the outcome, including what role a human actually played ⁷.

The definition is narrow, so a tool that only assists a recruiter may fall outside it, and the rules are privacy law rather than an employment remedy ⁷.

One federal route depends on no state at all. Where a third-party vendor produced the report, the rule that can get you a copy of your hiring score can reach the document itself. That is a different thing from an account of how it was made.

Write the Second Request

Ask a narrower question than the first one asked. A request for the algorithm invites the reply you already have, and the EU court's ruling does not entitle you to it. A request for the procedure and the principles applied to your own application asks for something a refusal has to engage with. Name the provision, and put a date on the reply.

Three things make a second message harder to wave off. Name the right you are relying on and the place you applied from, because both decide whether any of this reaches the employer at all. Ask for the logic in terms you can follow rather than for the tool. Then say where the request goes next if nothing arrives, which in Europe means the supervisory authority the Court pointed at ¹.

Naming a provision is not a threat, and all three are reasonable things to ask.

Sometimes the platform publishes its own list. HackerRank's candidate AI notice lists what a candidate may request. The list names human review of a decision made or substantially assisted by AI, correction of inaccurate personal information, and an explanation of how AI was used after an adverse decision ⁸. The notice sends those requests to the employer rather than to the vendor, and a published list is not a statement that anyone has to grant it.

Read the vendor's own page before you write the message.

Employers are told about this ground too, and what an employer owes a candidate the AI screened out is the version written for the other chair. Where the sticking point is a person looking again rather than the logic, how to ask for a human review after an automated rejection is a separate request with its own answer.

A refusal naming a trade secret has at least conceded that software played a part in the decision.

Read the evidence >