Luxembourg, 4 September 2025
Judgment of the EU Court in Case C-413/23 P | EDPS v SRB (Concept of personal data)
The Court of Justice clarifies the scope of the concept of personal data in the context of a transfer of pseudonymised data to third parties
The Court of Justice sets aside the judgment of the General Court which had annulled the decision of the European Data Protection Supervisor
Following the resolution of Banco Popular Español, on 7 June 2017, the Single Resolution Board (SRB) adopted a preliminary decision on whether or not it was necessary to grant compensation to the former shareholders and creditors of that bank as a result of that resolution. Since that decision was adopted without hearing those persons, the SRB subsequently organised a procedure to enable them to submit comments on that preliminary decision.
In the context of that procedure, the SRB transferred some of those comments, in the form of pseudonymised data, to Deloitte, an auditing and advisory company tasked by the SRB with carrying out a valuation of the effects of the resolution procedure on shareholders and creditors.
A number of affected shareholders and creditors submitted complaints to the European Data Protection Supervisor (EDPS) on the grounds that the SRB had not informed them that data relating to them would be transmitted to third parties, namely Deloitte.
The EDPS found that, in the present case, Deloitte was a recipient of the complainants’ personal data. In addition, he found that the SRB had infringed the obligation to provide information laid down in Regulation 2018/1725. 1 The SRB then brought an action for annulment of the EDPS’s decision before the General Court of the European Union. The General Court upheld that action in part and annulled the decision in question. 2
Hearing an appeal brought by the EDPS, the Court of Justice has set aside the judgment of the General Court and referred the case back to it.
The Court of Justice has found, in the first place, that the General Court erred in law in holding that the EDPS, in order to conclude that the information contained in the comments transmitted to Deloitte ‘related’, within the meaning of Regulation 2018/1725, to the persons who submitted those comments, should have examined the content, purpose or effects of those comments, whereas it was common ground that they expressed the personal opinion or point of view of their authors.
According to the Court of Justice, the General Court’s interpretation misconstrues the particular nature of personal opinions or views which, as an expression of a person’s thinking, are necessarily closely linked to that person.
In the second place, the Court of Justice has confirmed that the General Court was correct in so far as it held that pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of Regulation 2018/1725. It follows from the provisions of that regulation as interpreted in case-law that pseudonymisation may, depending on the circumstances of the case, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable. In that context, the Court of Justice is careful to recall the guidance from its case-law regarding the assessment of whether or not the data subject is identifiable in situations in which the information enabling that subject to be identified was not in the hands of other people.
In the third place, the Court of Justice has found that the General Court erred in law in holding that, in order to assess whether the SRB had complied with its obligation to provide information, the EDPS should have examined whether the comments transmitted to Deloitte constituted, from Deloitte’s point of view, personal data. According to the Court of Justice, it is clear from case-law that the relevant perspective for assessing the identifiable nature of the data subject depends, in essence, on the circumstances of the processing of the data in each individual case.
With regard to that obligation to provide information, the Court of Justice notes that that obligation is part of the legal relationship between the data subject and the controller and, therefore, it concerns the information in relation to that data subject as it was transmitted to that controller, thus before any potential transfer to a third party. Accordingly, the Court of Justice has found that the identifiable nature of the data subject must be assessed at the time of collection of the data and from the point of view of the controller.
The SRB’s obligation to provide information was applicable prior to the transfer of the data at issue and irrespective of whether or not those data were personal data, from Deloitte’s point of view, after any potential pseudonymisation.
NOTE: An appeal, on a point or points of law only, may be brought before the Court of Justice against a judgment or order of the General Court. In principle, the appeal does not have suspensive effect. If the appeal is admissible and well founded, the Court of Justice sets aside the judgment of the General Court. Where the state of the proceedings
so permits, the Court of Justice may itself give final judgment in the case. Otherwise, it refers the case back to the General Court, which is bound by the decision given by the Court of Justice on the appeal.
Unofficial document for media use, not binding on the Court of Justice. The full text and, as the case may be, the abstract of the judgment is published on the CURIA website on the day of delivery.
—
1 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
2 Judgment of the General Court of 26 April 2023, SRB v EDPS, T-557/20.
Source – curia.europa.eu