Court case T-557/20 SRB v. EDPS – Court Ruling (European Union, 2023)

Following its decision concerning a resolution scheme, a controller (the Single Resolution Board or SRB) invited affected shareholders and creditors (the data subjects) to express their interest to be heard through an online form. In order to be heard, the shareholders and creditors had to submit supporting documentation to SRB, including proof of identity and ownership (the registration phase). The identified shareholders and creditors submitted their comments to SRB (the consultation phase). These comments were examined by SRB and by a third party. SRB had published a privacy statement on its website, but it did not mention the third party as a recipient of the personal data collected in this consultation phase. Comments submitted by the shareholders and creditors were each assigned with an alphanumeric code. Some comments were transmitted to the third party with the alphanumeric code associated to the comment. The EDPS received five (5) complaints from shareholders and creditors who had submitted comments (the complainants). The complainants' argued that SRB had not informed them about the fact that their comments collected in the consultation phase would be transmitted to a third party. In its original decision, the EDPS found that SRB had infringed [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 15(1)(d) of the] [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Regulation 2018/1725] (the Regulation) because it had not informed the complainants about the disclosure of their personal data to the third party in question. SRB argued that the information that was transmitted to the third party did not constitute personal data and requested the EDPS to revise its original decision. In its revised decision, the EDPS upheld its view of SRB infringing its obligation to inform the data subjects about the recipients of their personal data. Furthermore, the EDPS specified that (1) the disclosed data constituted pseudonymous data (i.e. personal data) because SRB had also shared the alphanumeric codes with the third party – notwithstanding the fact that the third party had not receive additional information necessary to identify the the data subjects, and that (2) the third party is a recipient pursuant to [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 3(13) of the Regulation]. SRB seeked for an annulment of the EDPS’s decision before the European General Court. The General Court agreed with the EDPS that the fact that the third party did not have the additional information necessary to identify the authors of the comments, does not alone exclude that the information transmitted would not constitute personal data. However, the General Court , by citing [https://curia.europa.eu/juris/document/document.jsf?text=&docid=184668&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=5578095 Case C-582/14 Breyer], considered it is necessary to make the assessment from the view of the third party receiving the information in order to determine whether the information transmitted constituted personal data. The General Court viewed that the EDPS was wrong to assess the question from the controller’s (SRB) view and not from the third party’s view who received the information in question. The EDPS should have determined whether the possibility of combining the information that had been transmitted to the third party with additional information held by the controller constituted “means likely reasonable” to be used by the third party for identifying the data subjects. Eventually, the General Court ruled that the EDPS had not appropriately investigated whether the third party had legal means available to it which could, in practice, enable it to access the additional information necessary to re-identify the data subjects. Therefore, the General Court viewed that the EDPS could not conclude that the information transmitted to the third party constituted personal data within the meaning of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 3(1) of the Regulation]. The General Court ordered that the EDPS’s revised decision must be annulled, and so the controller was successful in its appeal.