European Union: Advocate General issued an opinion on EDPS's appeal of General Court's judgment

On 6 February 2025, the Advocate General issued an opinion on the European Data Protection Supervisor’s (EDPS) appeal of the judgment of the General Court of the European Union. The dispute concerned the Single Resolution Board’s (SRB) sharing of pseudonymised data with Deloitte during the resolution of Banco Popular Español SA, without informing affected shareholders and creditors. The General Court had annulled the EDPS’s ruling, holding that the data were not personal data from Deloitte’s perspective because the firm could not re-identify the individuals. The EDPS argued this interpretation was wrong, stressing that pseudonymised data remain personal data if the controller can re-identify individuals, and that the duty to inform data subjects applies regardless of the recipient’s ability to do so. The Advocate General agreed, finding that the General Court’s reasoning was flawed. He concluded that the obligation to inform must be assessed from the controller’s perspective and that the SRB should have notified data subjects of the transfer to Deloitte. Accordingly, he recommended setting aside the General Court’s judgment.