{"id":100014,"date":"2025-09-04T12:06:38","date_gmt":"2025-09-04T11:06:38","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100014"},"modified":"2025-09-05T08:48:41","modified_gmt":"2025-09-05T07:48:41","slug":"when-is-pseudonymized-data-still-personal-data","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/wanneer-is-gepseudonimiseerde-data-nog-steeds-een-persoonsgegeven\/","title":{"rendered":"When is pseudonymized data still personal data?"},"content":{"rendered":"

Transferring data after identifying characteristics such as a name have been removed is an everyday practice. But when is this \"pseudonymized\" information still considered personal data under the General Data Protection Regulation (GDPR)<\/a>? In a judgment of 4 September 2025<\/a> (C-413\/23 P), the European Court of Justice clarified this issue. The conclusion is nuanced: although data may be anonymous to the recipient, the original party collecting the data (the controller) remains bound by the transparency obligation and must inform the data subject about the transfer.<\/p>\n\n\n\n

The facts: the case of EDPS v. SRB<\/h2>\n\n\n\n

The case revolved around the resolution of Spanish bank Banco Popular. The European Single Resolution Board (SRB)<\/a>, the central resolution authority within the banking union, collected comments from shareholders and creditors in this context. To have these comments analyzed, the SRB forwarded them to the consultant Deloitte. <\/p>\n\n\n\n

Crucially, the SRB had pseudonymized the data: the names of the individuals were replaced by a unique alphanumeric code. Only the SRB possessed the key to re-link this code to a specific person. Deloitte was thus unable to identify the authors. Some shareholders filed a complaint about this with the European Data Protection Supervisor (EDPS)<\/a>, the European privacy regulator. Their argument: they were never informed that their comments would be shared with a third party such as Deloitte. <\/p>\n\n\n\n

The EDPS vindicated the complainants and ruled that the SRB had violated its duty to provide information. <\/sup>However, the EU General Court overturned this decision, <\/sup>after which the case came before the Court of Justice. <\/sup><\/p>\n\n\n\n

The decision of the Court of Justice<\/h2>\n\n\n\n

The ECJ overturned the General Court's ruling and largely found in favor of the EDPS, albeit based on very nuanced reasoning. <\/sup> The judgment falls into three key points:<\/p>\n\n\n\n

    \n
  1. A personal opinion is personal data:<\/strong> The Court states unequivocally that personal opinions or views, as expressions of a person's thoughts, are inseparable from that person. An analysis of content, purpose or effect is not necessary to conclude that such information \"relates to\" a natural person. <\/li>\n\n\n\n
  2. The term \"personal data\" is relative:<\/strong> The Court confirms that pseudonymized data should not be considered personal data in all cases and for everyone. Whether data are identifiable depends on the context and the resources available to a party. Thus, it is perfectly possible that data for the recipient (Deloitte) is not personal data, because it does not have the means to identify those involved, while the same data remains personal data for the sender (SRB). <\/li>\n\n\n\n
  3. The duty to disclose is assessed from the point of view of the controller:<\/strong> This is the crux of the judgment. The obligation to inform a data subject (including about the recipients of his data) arises at the time of data collection. To assess whether this duty has been met, one must place oneself in the perspective of the data controller (the SRB) at that time. Since the SRB could trace the data back to the individuals, they were personal data for the SRB. Thus, the SRB should have informed the data subjects of the potential transfer to Deloitte, regardless of whether or not the data were identifiable to Deloitte. <\/li>\n<\/ol>\n\n\n\n

    Legal analysis and interpretation<\/h2>\n\n\n\n

    This ruling brings clarity to a long-running debate involving two opposing views of the concept of personal data: the absolute<\/strong> and relative approach<\/strong>. According to the absolute view, data remain personal data as long as re-identification is theoretically possible, regardless of who holds the data. In contrast, the relative or contextual approach holds that qualification depends on the specific party holding the data and their reasonable ability to identify the person.<\/p>\n\n\n\n

    In this judgment, the Court of Justice unequivocally opts for the relative or contextual approach<\/strong>, which was already initiated in the Breyer<\/em>-ruling<\/a>. Data are not personal data in the abstract; their qualification depends on whether a specific party (the holder or recipient) has means by which they can reasonably be expected to identify a person. The Court clearly states that \"...pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data ...<\/em>\". The Court thus goes directly against this, which is a major victory for data-driven sectors such as scientific research and AI development<\/p>\n\n\n\n

    At the same time, the Court places a fundamental caveat here. The principles of transparency and accountability of the original data controller weigh more heavily at the time of data collection. The obligation under Article 15 of Regulation 2018\/1725<\/a> (the equivalent of Articles 13 and 14 GDPR) is precisely to enable the data subject to make an informed decision on whether or not to provide his data. The Court therefore held that identifiability for this particular obligation must be assessed from the point of view of the controller at the time of collection. <\/p>\n\n\n\n

    Thus, the Court's reasoning is twofold: the concept is relative, but the obligations of the controller are not. The controller cannot hide behind the technical measures of pseudonymization to circumvent its own basic transparency obligations.<\/p>\n\n\n\n

    What this specifically means<\/h2>\n\n\n\n