DATA PROTECTION | The CJEU on pseudonymised data

On 4 September 2025, the EU Court of Justice (CJEU) issued a key ruling in case C-413/23 P (EDPS v SRB) on the distinction between pseudonymisation and anonymisation of personal data. Following the bankruptcy of Banco Popular Español, the Single Resolution Board (SRB) invited former creditors and shareholders of the bank to provide input on whether compensation should be granted. Several comments were then pseudonymised and transmitted to an external advisory firm without informing the individuals concerned. Notably, the SRB replaced the commenters’ names with numbers that only the SRB itself could link back to the data subjects. The case was brought before the European Data Protection Supervisor (EDPS), which held the SRB liable for breaching Article 15 of Regulation (EU) 2018/1725 (Regulation) by failing to inform data subjects about the recipients of their data.  A key issue in the proceedings was whether the comments shared with advisory firm could be considered anonymous data.

The CJEU held that, in order to determine whether pseudonymised information transmitted to a recipient qualifies as personal data, the assessment must focus on the recipient’s perspective. As the recipient advisor firm had no additional information enabling re-identification of the data subjects and no legal means to obtain such information, data qualified as anonymous.  By contrast, the CJEU clarified that, when assessing whether there has been a breach of duty pursuant to Article 15 of the Regulation, the relevant perspective is that of the controller, at the time of data collection. Even though the advisory firm could not identify the individuals, the SRB nevertheless breached its information obligations by transmitting the data without informing the data subjects.

Newsletter n. 110 – August/September 2025