EU Court of Justice Clarifies Definition of “Personal Data” in the Context of Pseudonymization

The CJEU’s recent ruling clarifies that pseudonymized data does not automatically become non-personal data for all recipients. The determination depends entirely on whether the specific third party can reasonably re-identify individuals. This establishes that data classification is contextual and recipient-dependent, requiring organizations to assess their own capabilities rather than relying on blanket assumptions about data anonymization. Furthermore, data controllers must maintain transparency obligations even when sharing pseudonymized information with parties incapable of re-identification. The ruling emphasizes that notifying data subjects about potential sharing is mandatory, regardless of the recipient’s technical ability to link the data back to specific individuals. This ensures that individuals remain informed about how their information is used, preserving trust in data processing activities across sectors. Finally, the decision confirms that personal opinions inherently constitute personal data, eliminating the need for additional analysis to prove a connection to an identifiable person. For the open data community, this ruling is vital as it defines the boundaries of data utility and privacy. It underscores that releasing data requires rigorous assessment of recipient capabilities and strict adherence to transparency, ensuring that open data initiatives respect fundamental privacy rights while promoting accessible information.

Source: natlawreview.com
Published on 2025-09-11

EU Court of Justice Clarifies Definition of “Personal Data” in the Context of Pseudonymization

Related news