EDPS – CJEU Judgment (European Union, 2025)

In June 2017, the Single Resolution Board (SRB) adopted a resolution scheme in respect of Banco Popular Español SA. In order to determine whether the shareholders and creditors affected by the resolution action would have received better treatment if that bank had entered into normal insolvency proceedings, SRB asked Deloitte, an auditing and advisory company, to carry out the valuation. Once that valuation was drawn up, in August 2018, the SRB adopted a preliminary decision on whether compensation needed to be granted to the shareholders and creditors (participants), and launched a right to be heard process in order to allow it to adopt a final decision. The participants were invited to express their opinions using an online registration form which permitted SBR to verify their status as affected shareholders and creditors. In the context of that procedure, in June 2019, the SRB transferred some of those comments, in the form of pseudonymised data bearing an alphanumeric code, to Deloitte. Later in 2019, a number of affected participants submitted complaints to the European Data Protection Supervisor (EDPS). They alleged that the SRB had failed to inform them that the data collected through their responses on the forms would be transmitted to third parties, in breach of the terms of its privacy statement. In its decision in November 2020, the EDPS held that the pseudonymous data shared by the SRB constituted personal data because the SRB shared the alphanumeric code that allowed linking the replies to the participants. It found that Deloitte was a recipient of personal data and therefore SRB had infringed the obligation to provide information laid down in Regulation 2018/1725 by not including it in the privacy policy. The SRB brought an action for annulment of the EDPS’s decision before the General Court of the European Union, arguing that the information transmitted to Deloitte did not constitute personal data. The General Court of the European Union upheld the action in part and annulled the decision in question ([https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=T-557/20 T‑557/20]). The General Court pointed out that opinions and views constitute personal data only if they are linked to a particular person. It determined that since EDPS did not carry out such an examination, it could not conclude that the information transmitted to Deloitte constituted information ‘relating’ to a natural person within the meaning of Article 3(1) of Regulation 2018/1725. The EDPS appealed the judgment of the General Court before the Court of Justice of the European Union (CJEU), asking to be set aside, claiming that the General Court erred in law in its interpretation of Article 3(1) and (6) of Regulation 2018/1725. = == The AG opined that a (mere) presumption may apply when assessing if a comment ‘relates’ to its author, but that the comments even without such a presumption ‘relate’ to the data subjects by reason of their content, purpose and effect because they were liable to have an effect on the data subjects’ interests and rights regarding financial compensation. Additionally the AG held, that the aggregated content still reflects personal views, constituting a sum of opinions relating those who expressed them. Otherwise, the AG found, one could avoid the requirement of information ‘relating’ to a natural person by just aggregating them. Therefore the AG took the view that the GC’s assessment is erroneous as it considered that the EDPS had wrongfully found the comments at issue to be ‘related’ to natural persons, within the meaning of Article 3(1) EUDPR. == The AG states, that the question of identifiability illustrates the existence of two very different approaches to the scope of data protection rules, framing the question such: Should pseudonymised data be included within that scope automatically, irrespective of the accessibility of the additional identification data, or should the data following the pseudonymisation process be considered personal data only for those persons who can reasonably identify the data subjects? Firstly, the AG found, that the wording of Recital 16 EUDPR would be pointless if pseudonymisation would not leave open the possibility that the data subjects may not be identifiable. The AG draws a parallel to anonymisation: anonymised data is excluded from the scope of the EUDPR but pseudonymised data is only excluded in so far as the data subjects are not identifiable. Therefore the AG concludes, that pseudonymised data may fall outside the scope of the concept of ‘personal data’ but only where the risk of identification is non-existent or insignificant. The AG considers this to be a strict interpretation of the concept of personal data in line with the objective of ensuring a high level of protection of personal data. The AG states, that the fact that the EUDPR does not apply to data relating to non-identifiable persons does not preclude legal liability where appropriate. On the other hand, the AG found it disproportionate to impose on an entity obligations arising from the EUDPR, which cannot not reasonably identify the data subjects, as this would specifically require it to attempt to identify the data subjects. Therefore, the AG agrees with the GC that it was necessary to determine whether the pseudonymisation of the data at issue was sufficiently robust to conclude that the data subjects were not reasonably identifiable. == The AG opined, that the obligation to provide information of Article 15(1)(d) EUDPR, is - parallel to Breyer - part of the legal relationship between the data subjects, on the one hand, and the controller on the other, and not part of the relationship between the controller and the recipient, namely the processor. Therefore, the AG found, that the controller was obliged to provide information prior to the transfer of the data at issue and irrespective of whether or not they were personal data in the processor’s possession. Therefore, the issue of whether or not pseudonymisation is sufficiently robust and effective ultimately does not seem to the AG to be material regarding the controller’s obligation to provide information. Consequently, the AG is of the opinion, that the judgment under appeal must be set aside. = The AG stated, that if it was alternatively accepted that the recipient’s point of view was relevant in the present case, the AG agrees with the GC, that it was for the EDPS to demonstrate why the pseudonymisation was not sufficient. This is because, in the AG's opinion the controller is discharged of its burden of proof by pointing to the filtering, categorisation and aggregation of comments. The AG was therefore of the opinion that, the judgment under appeal should be upheld as regards this ground of appeal. = The AG concludes, that since the controller failed to fulfill its obligation to provide information under Article 15(1)(d) EUDPR, the EDPS' decision at issue should therefore be confirmed. First, the Court pointed out that the scope of the concept of personal data set out in Article 3(1) of Regulation 2018/1725 is essentially identical to that in Article 4(1) GDPR. Second, the CJEU held that personal opinions or views, as an expression of a person’s thinking, are necessarily closely linked to that person and constitute personal data. Third, the CJEU confirmed that the General Court was correct in so far as it held that the existence of additional information enabling the data subject to be identified does not, in itself mean that pseudonymised data must be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of Regulation 2018/1725. The CJEU ruled that the identifiable nature of the data subject must be assessed at the time of collection of the data and from the point of view of the controller. In so far as pseudonymisation may, depending on the circumstances of the case, efficiently prevent third parties other than the controller from identifying the data subject, for the third parties pseudonymised data must not be considered personal data. Nevertheless, in so far as it cannot be ruled out that those third parties have means that reasonably allow them to attribute pseudonymised data to the data subject, the data subject must be regarded as identifiable. On the other hand, data which are in themselves impersonal for the controller may become ‘personal’ in nature where the controller puts them at the disposal of third parties who have means reasonably likely to enable the data subject to be identified. Those data are personal data both for the third parties and, indirectly, for the controller. Accordingly, the CJEU held that it was only the SRB who was able, via that code, to link the comments to the data, in particular to the identification data of the authors of the comments, received during the registration phase. Deloitte did not have access to the database of data collected during the registration phase. In the third place, the CJEU found that the General Court erred in law in holding that, in order to assess whether the SRB had complied with its obligation to provide information, the EDPS should have examined whether the comments transmitted to Deloitte constituted, from Deloitte’s point of view, personal data. The obligation to provide information laid down in Article 15(1)(d) of Regulation 2018/1725 is part of the legal relationship between the data subject and the controller and, therefore, it concerns the information in relation to that data subject as it was transmitted to that controller, thus before any potential transfer to a third party. The CJEU concluded that the identifiable nature of the data subject must be assessed at the time of the collection of the data and from the point of view of the controller.