Case T-557/20, SRB v. EDPS decision: When Pseudonymized Data is Considered Personal Data?

On 26th April, the General Court handed down its judgment in Case T-557/20, SRB v. EDPS, concerning an action for annulment brought by the Single Resolution Board (SRB) against a decision of the European Data Protection Supervisor (EDPS).

Case facts: SRB used an electronic form for interested parties to express their views and shared the responses received with a consulting firm. Before sharing the responses, SRB replaced the name of each respondent with a code. That was done without the notice of that for data subjects. The SRB considered that providing that information was unnecessary because the data transmitted were anonymized and, consequently, could not be considered personal data for the data recipient. Number if complaints followed.

The Court held: pseudonymized data transmitted to a data recipient WILL NOT be considered as personal data if the data recipient does not have the means to re-identify the data subjects. The Court also clarified that an individual’s opinions cannot be assumed to be personal data; instead, a case-by-case assessment is necessary.

The General Court highlighted that, in line with the Court of Justice’s decision in Breyer (see our blog here), in order to determine whether pseudonymized information transmitted to a data recipient constitutes personal data, it is necessary to consider the data recipient’s perspective. If the data recipient does not have any additional information enabling it to re-identify the data subjects and has no legal means available to access such information, the transmitted data can be considered anonymized and therefore not personal data. The fact that the data transmitter has the means to re-identify data subjects is irrelevant and does not mean that the transmitted data is automatically also personal data for the recipient.

Opinions as personal data. The General Court also held that, while personal views or opinions may constitute personal data, they cannot be presumed to be so; instead, a case-by-case assessment “based on the examination of whether, by its content, purpose or effect, a view is linked to a particular person” is needed.

Appeal. The General Court’s judgment can be appealed to the Court of Justice of the European Union.

Sources: https://www.insideprivacy.com/eu-data-protection/eu-general-court-clarifies-when-pseudonymized-data-is-considered-personal-data/