The Court of Justice of the European Union (CJEU) has clarified the definition of personal data in a ruling concerning the transfer of pseudonymised information to third parties. The decision, delivered on September 4, 2025, in case C-413/23 P (EDPS v SRB), sets aside a previous judgment of the General Court and refines the legal boundaries of data protection under Regulation (EU) 2018/1725.
The case stems from the 2017 resolution of Banco Popular Español, when the Single Resolution Board (SRB) engaged Deloitte to assess compensation claims from former shareholders and creditors. In doing so, the SRB transferred pseudonymised comments from affected parties to Deloitte. Complaints later reached the European Data Protection Supervisor (EDPS), which ruled that Deloitte had received personal data without proper notification to those individuals. The General Court annulled that decision in 2023, prompting the EDPS to appeal.
In its ruling, the Court of Justice emphasized that personal opinions or views expressed by individuals are inherently linked to their identity, even when pseudonymised. It held that the General Court erred in requiring an additional assessment of content, purpose, or effects to determine whether such data related to identifiable persons. At the same time, the Court acknowledged that pseudonymised data is not always personal data, depending on whether the recipient can reasonably re-identify individuals.
Crucially, the Court also ruled that the SRB’s duty to inform data subjects applied at the time of collection and from the controller’s perspective, regardless of how the data might later appear to third parties. This interpretation reinforces the responsibility of data controllers to ensure transparency before any transfer of information.
The case has been referred back to the General Court for further proceedings, but the ruling is expected to shape future debates on pseudonymisation, accountability, and the scope of personal data protection in the European Union.
Need Help?
If you’re wondering how these measures, or any other AI regulations and laws worldwide could impact you and your business, don’t hesitate to reach out to BABL AI. Their Audit Experts can address your concerns and questions while offering valuable insights
