Court of Justice of the European Union Rules on Pseudonymised Data and Transparency Duties in Case EDPS v SRB 

On 4 September 2025, the Court of Justice of the European Union (CJEU) delivered a key judgment in the case C‑413/23 P - European Data Protection Supervisor v Single Resolution Board. The ruling clarifies what counts as “personal data” and highlights important practical issues around pseudonymisation. 

Although the case concerned the EU Data Protection Regulation (Regulation 2018/1725), which applies to personal data processed by EU institutions and bodies, its definition of personal data and transparency obligations align closely with those set out in the GDPR (Regulation 2016/679). This means the Court’s findings are directly relevant also for organisations operating under the GDPR. 

This article outlines the main points from the judgment and offers concise recommendations to support organisational compliance.  

Background to the case 

Following the resolution of Banco Popular Español on 7 June 2017, the Single Resolution Board (SRB), issued a preliminary decision on whether compensation was owed to former shareholders and creditors.  This was to determine if they would have received better treatment through a regular insolvency process instead of resolution. Since those shareholders and creditors had not been consulted before the decision was made, the SRB later invited them to submit comments through a public consultation process, as required by EU rules on fair treatment. 

Some of these comments were shared in pseudonymised form with Deloitte, the firm tasked with analysing the resolution’s impact. Each comment was tagged with a unique alphanumeric code, with all directly identifying details removed. The “additional information” necessary to re-identify the individuals associated with the comments was held exclusively by the SRB.  

Several affected individuals complained to the European Data Protection Supervisor (EDPS), arguing that the SRB’s privacy statement had not disclosed this data sharing, potentially breaching the transparency requirements pursuant to Article 15(1)(d) of the EU Data Protection Regulation. The EDPS found that the data shared with Deloitte constituted personal data, despite its pseudonymisation, since the SRB retained the necessary information to re-identify individuals. As a result, the EDPS concluded that the SRB had breached its duty to inform individuals. The SRB challenged this decision before the General Court, which partially upheld the challenge and annulled the EDPS’s decision. 

However, following an appeal by the EDPS, the CJEU overturned the General Court’s ruling and addressed key issues concerning the definition of personal data, pseudonymisation, and transparency obligations, which are presented in the next section of this post.  

Core findings from the CJEU Ruling 

Personal opinions as personal data: The CJEU overturned the General Court’s judgment, finding it had applied the wrong legal test when assessing whether the comments submitted to Deloitte qualified as personal data. The General Court held that the EDPS should have examined the content, purpose, or effect of the comments to determine whether they "related to" identifiable individuals under the EU Data Protection Regulation. The CJEU rejected this argument, clarifying that such an assessment is unnecessary where the comments clearly express the personal opinions or views of their authors. It emphasised that personal opinions are, by their nature, directly connected to the individual expressing them. As such, they constitute personal data without requiring further analysis. If it is undisputed that the information reflects someone's own views, it inherently "relates to" that person for the purposes of data protection law. 

Pseudonymised data is not always personal data: The CJEU confirmed the General Court’s position that pseudonymised data is not automatically considered personal data under the EU Data Protection Regulation. Pseudonymisation removes direct identifiers but retains a separate key (or additional information) that could lead to the re-identification of individuals. Whether it qualifies as personal data depends on the context and, in particular, on the recipient’s ability to re-identify the individuals. The crucial question is whether the recipient, in this case, Deloitte, has access to that key or any other means of re-identification. The Court reaffirmed the "reasonably likely" test: data is only personal if the individual can realistically be identified, not merely in theory. Where re-identification would require disproportionate effort or is legally prohibited, the data may be considered anonymous to that party. This relative, context-based approach departs from the stricter stance taken by some data protection authorities, where even a remote or theoretical possibility of identification was enough to bring the data within the scope of data protection legislation. 

Transparency obligations are assessed at the point of collection: The Court clarified that the obligation to provide information under EU Data Protection Regulation arises at the time of data collection and must be assessed from the controller’s perspective, in this case, the SRB. This duty is part of the legal relationship between the controller and the data subject. It applies before any processing, including any pseudonymisation, or transfer takes place. Whether the recipient (Deloitte) could later identify the individuals is irrelevant to whether the SRB met its transparency obligations. In short, the SRB, as controller, was required to inform data subjects about potential data recipients upon data collection, regardless of how the data might later be transformed or interpreted by others.  

Key takeaways and recommendations 

Controllers must inform individuals about how their personal data will be used and shared, regardless of whether the data will be anonymous to the recipient. This approach facilitates smoother data sharing by potentially relieving recipients from data protection obligations, but it places the onus on organisations to conduct careful risk assessments. 

To ensure compliance and minimise risks, we advise organisations to: 

• Conduct comprehensive re-identification risk assessments: Evaluate the realistic likelihood that individuals could be re-identified from the data. This assessment should take into account all reasonably available means, including the cost, time, and technological capabilities required, as well as any legal restrictions. Risk assessments should be ongoing and flexible, adapting to changes such as technological advancements or the emergence of new information from other sources. 

• Ensure transparency in privacy policies: Clearly list all data recipients in privacy notices, even in cases where the personal data will be anonymised or pseudonymised before being shared with third parties. 

• Apply robust contractual safeguards: Formalise contractual agreements that explicitly prohibit any attempt to re-identify individuals. These agreements should also require recipients to implement and maintain appropriate technical and organisational security measures throughout the entire duration of the service.  

Our Data Protection team has extensive experience in assisting organisations and European Union Institutions with the development of robust compliance plans to address EU Data Protection Regulation and GDPR requirements. Feel free to contact our advisors if you would like to receive expert assistance in data protection compliance.