CJEU Judgement Addresses Personal Data Interpretation

The Court of Justice of the European Union ruled that pseudonymized data, such as shareholder comments linked to individuals via a separate database, still qualifies as personal data under EU law. The court emphasized that identifiability must be assessed from the controller’s perspective, considering all reasonably likely means of re-identification, rather than just the recipient’s immediate capabilities. Consequently, even if a third party cannot instantly identify the subjects, the data remains protected as personal information. A critical holding of the judgment is that data controllers must inform data subjects about the disclosure of their personal data to third parties at the time of collection. This obligation persists regardless of whether the data has been pseudonymized or if the recipient lacks the technical means to re-identify individuals. The decision reinforces that transparency is intrinsic to fair processing, and relying on pseudonymization does not exempt organizations from the duty to provide clear, comprehensive privacy notices regarding potential data sharing. This ruling is highly relevant to open data initiatives because it clarifies the limits of anonymization techniques. It serves as a warning that simple pseudonymization may not be sufficient to render data non-personal if re-identification risks remain reasonably likely from the controller’s standpoint. Organizations handling public or shared data must ensure robust privacy communication and rigorous assessment of identifiability risks, rather than assuming that removing direct identifiers automatically frees them from GDPR obligations.

Source: natlawreview.com
Published on 2025-10-04

CJEU Judgement Addresses Personal Data Interpretation

Related news