European Court Finds Pseudonymized Data Is Not Personal Data In The Hands Of Recipient That Can't Re-identify It

• Jurisdiction: European Union
• Law Firm: Goodwin Procter LLP
• Subject Matter: Privacy, Data Protection
• Author: Lore Leitner, Josephine Jay and Joseph Ndep
• Published date: 16 May 2023

On April 26, 2023, the General Court of the European Union issued a ruling in Case T-557/20, SRB v EDPS, finding that pseudonymized data shared by one party with another will not be considered personal data in the hands of the recipient, if the recipient does not have legal means to re-identify the individuals behind the data. The General Court also addressed the matter of personal opinions being considered personal data, clarifying that just because personal opinions can qualify as personal data, they are not automatically personal data - each situation must be assessed on a case-by-case basis.

Background

This case arose out of a shareholder survey undertaken by the Single Resolution Board (SRB) as part of which it shared the resulting responses with a third party consulting firm. Before doing so, SRB pseudonymized that data by replacing the name of each respondent with alphanumeric code, to ensure responses could not be linked back to individuals. The decoding key capable of linking the alphanumeric codes to individual respondents was not shared with the consulting firm.

Following a number of complaints by survey participants, the European Data Protection Supervisor (EDPS) determined that SRB had shared pseudonymized personal data with the consulting firm without informing the affected individuals of this sharing. To qualify as personal data under the GDPR, data must "relate" to a natural person, and that person must be "identified or identifiable". SRB appealed to the General Court, rejecting the EDPS determination that the survey data shared met these cumulative conditions.

"Identified or identifiable": General Court ruling on pseudonymized personal data

The General Court clarified that the analysis of whether or not data is pseudonymized and therefore personal data, or anonymized and therefore outside of the scope of the GDPR, should take into account the circumstances of the party holding the data. The General Court found that pseudonymized data shared with a...