Court of Justice clarifies identifiability under GDPR
The Court of Justice has allowed the European Data Protection Supervisor’s (EDPS) appeal, setting aside the General Court’s judgment in SRB v EDPS (T‑557/20). The case concerned complaints by former shareholders and creditors of Banco Popular who said they were not informed that comments they submitted could be shared with Deloitte, which had been appointed to assess the resolution’s impact. The EDPS had found that the Single Resolution Board (SRB) breached Regulation (EU) 2018/1725 by failing to inform data subjects that Deloitte would receive their data; the General Court partially annulled that finding, but the Court of Justice has now reversed the General Court’s decision.
The Court of Justice clarified that the General Court erred by requiring the EDPS to examine the content, purpose and effects of the submitted comments to decide whether the information transmitted to Deloitte “related” to the individuals. The Court emphasized that personal opinions are inherently tied to the person expressing them, so there was no need for the EDPS to perform that specific content-focused assessment when determining whether the SRB should have provided information to data subjects before sharing their comments.
The Court confirmed that pseudonymised data is not automatically personal data in every situation under Regulation 2018/1725. Whether pseudonymised information qualifies as personal data depends on the circumstances, in particular whether a third party could reasonably re-identify the individuals. That contextual test remains essential for assessing whether pseudonymised comments fall within the scope of the regulation.
Finally, the Court found that the General Court was wrong to require the EDPS to assess whether the comments constituted personal data from Deloitte’s perspective. The identifiable nature of data must be assessed at the time of collection and from the controller’s viewpoint. Therefore, the SRB’s obligation to inform data subjects applied before transferring the comments to Deloitte, regardless of whether Deloitte could later identify individuals after any further processing.
