European Union: European Court of Justice issued a ruling clarifying conditions under which pseudonymized data can still be classified as personal information in EDPS appeal against SRB

On 4 September 2025, the Court of Justice of the European Union ruled on the appeal brought by the European Data Protection Supervisor concerning the Single Resolution Board’s data-sharing practices with Deloitte. The case centred on whether comments from shareholders and creditors, pseudonymised by the SRB before transfer, qualified as personal data under Regulation (EU) 2018/1725. The Court held that the General Court had erred in law. It confirmed that personal opinions are intrinsically linked to the individuals who express them, meaning the comments constituted personal data relating to identifiable persons without the need for a detailed analysis of their content or purpose. While the Court rejected the EDPS’s position that pseudonymised data is always personal data when the controller retains the key to re-identification, it clarified that the assessment must focus on the controller’s perspective, not the recipient’s. Since the SRB could identify the individuals, the data qualified as personal data, triggering the obligation to inform data subjects of potential recipients such as Deloitte.