CJEU ruling clarifies pseudonymised data is not always personal data

The Court of Justice of the European Union (CJEU) has delivered a judgment in case C 413/23, concerning whether pseudonymised data should always be classified as personal data under the EU General Data Protection Regulation (GDPR). In its ruling, the CJEU confirmed that pseudonymised data might not be considered personal data in every instance. Instead, the determination of whether it is personal data or not requires a context-specific assessment of the means reasonably likely to be used to identify an individual.

The ruling stems from a case involving an appeal by the European Data Protection Supervisor (EDPS). The EDPS had found that the EU Single Resolution Board (SRB) had violated the GDPR by sharing pseudonymised comments from insolvent Spanish bank creditors with the accounting firm, Deloitte.

The CJEU sided with the EDPS on two key points: that individuals' personal opinions are personal information and that the risk of reidentification must be evaluated on a case-by-case basis. However, the court also ruled in favour of the SRB, stating that pseudonymised data is not always personal data. The judgment confirms that where a controller collects, pseudonymises, and transfers personal data to a third party, the disclosing controller must still comply with its obligations to provide information to individuals on how their data will be processed.

Additional legal analysis by Baumbartner Baumann.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.