CJEU Gives Further Insights Over Data Anonymization

Background

Under Article 4(5) GDPR, pseudonymization refers to the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided such information is kept separately and subject to technical and organizational measures ensuring non-attribution. In contrast, Recital 26 GDPR defines anonymization as rendering data irreversibly non-identifiable, meaning that identification of a natural person is “reasonably” impossible.

The distinction between pseudonymization and anonymization is fundamental because only truly anonymized data fall outside the GDPR’s scope. However, in practice, this boundary has proven difficult to delineate.

The SRB v. EDPS case arose in the context of the Single Resolution Board’s (SRB) activities managing bank resolutions in the EU. The SRB received comments from shareholders and creditors, later transferring a version of these comments in pseudonymized form (stripped of direct identifiers) to Deloitte assisting in valuation. Upon the complaints, the EDPS found that the SRB had disclosed comments that were personal data without a valid legal basis, reasoning that the transmitted dataset remained personal data even though Deloitte could not identify individuals. According to EDPS, the fact that the firm did not have that re-identification information was not sufficient to classify the data as anonymous, and it concluded that SRB did not comply with Regulation (EU) 2018/1725. Following the assessment of the EU’s General Court (EGC) on the matter, EDPS challenged this decision before the CJEU, which issued below-covered decision.

Main Findings of the Decision

The CJEU’s decision provides some further guidance for multi-actor processing scenarios.

• Transparency Requirement Shall be Assessed at the Time of Collection: The controller has a duty to inform data subjects of possible data recipients at the time of data collection. 
• Pseudonymized Data Is Not Necessarily Personal Data for All Recipients: Meaning that the same pseudonymized data set can be personal data for an organization holding its key, and non-personal for other organizations lacking the key for re-identification^[2].
• Data May Remain Personal Even if the Recipient Cannot Identify Individuals:

The Court held that pseudonymized data does not become anonymized merely because the recipient lacks the additional information required for re-identification. What matters is whether any party involved in the processing, including the sender or another entity, has means “reasonably likely” to re-identify the data subjects. Hence, the transmitted dataset remained personal data in the hands of the SRB because it retained access to the key linking identifiers.

Conclusion

The SRB v. EDPS judgment consolidates the CJEU’s evolving jurisprudence on identifiability. The Court has made clear that pseudonymized data does not always constitute personal data. Categorization of personal data as pseudonymous or anonymous should be assessed from the relative perspective of the recipient or holder of the data^[3] .

Effectively pseudonymized data (without means for re-identification) may fall out of the scope of the GDPR, meaning fewer compliance requirements in data transfers. This could open the innovation path for responsible AI models and data-driven research. However, there is still some room to receive practical guidance on clear criteria for anonymization^[4] .