When pseudonymised data gets personal (EDPS v SRB)
Information Law analysis: This case involved an appeal concerning whether pseudonymised data must always be treated as personal data under Regulation (EU) 2016/679, the General Data Protection Regulation (EU GDPR). The Court of Justice dismissed the appeal in part, providing guidance on three key issues: the status of pseudonymised data, the meaning of data ‘relating to’ an individual, and transparency obligations when disclosing data to third parties. The Court of Justice rejected the argument that pseudonymised data is inherently personal data in all circumstances. Where robust measures prevent a recipient from re-identifying individuals, and the reidentification risk is insignificant, the data may be anonymous for that recipient, even while remaining personal for the controller. The Court of Justice also held that controllers must disclose all data transfers to third parties in privacy notices, even where data becomes effectively anonymous in the third party’s hands. In addition, the Court of Justice confirmed that personal opinions inherently relate to the individual expressing them and therefore always constitute personal data. Written by Max Gross, associate at Bird & Bird.