(AGENPARL) – Thu 04 September 2025 PRESS RELEASE No 107/25
Luxembourg, 4 September 2025
Judgment of the Court in Case C-413/23 P | EDPS v SRB (Concept of personal data)
The Court of Justice clarifies the scope of the concept of personal data in
the context of a transfer of pseudonymised data to third parties
The Court of Justice sets aside the judgment of the General Court which had annulled the decision of the
European Data Protection Supervisor
Following the resolution of Banco Popular Español, on 7 June 2017, the Single Resolution Board (SRB) adopted a
preliminary decision on whether or not it was necessary to grant compensation to the former shareholders and
creditors of that bank as a result of that resolution. Since that decision was adopted without hearing those persons,
the SRB subsequently organised a procedure to enable them to submit comments on that preliminary decision. In
the context of that procedure, the SRB transferred some of those comments, in the form of pseudonymised data, to
Deloitte, an auditing and advisory company tasked by the SRB with carrying out a valuation of the effects of the
resolution procedure on shareholders and creditors.
A number of affected shareholders and creditors submitted complaints to the European Data Protection Supervisor
(EDPS) on the grounds that the SRB had not informed them that data relating to them would be transmitted to third
parties, namely Deloitte. The EDPS found that, in the present case, Deloitte was a recipient of the complainants’
personal data. In addition, he found that the SRB had infringed the obligation to provide information laid down in
Regulation 2018/1725. 1 The SRB then brought an action for annulment of the EDPS’s decision before the General
Court of the European Union. The General Court upheld that action in part and annulled the decision in question. 2
Hearing an appeal brought by the EDPS, the Court of Justice has set aside the judgment of the General Court and
referred the case back to it.
The Court of Justice has found, in the first place, that the General Court erred in law in holding that the EDPS, in
order to conclude that the information contained in the comments transmitted to Deloitte ‘related’, within the
meaning of Regulation 2018/1725, to the persons who submitted those comments, should have examined the
content, purpose or effects of those comments, whereas it was common ground that they expressed the
personal opinion or point of view of their authors. According to the Court of Justice, the General Court’s
interpretation misconstrues the particular nature of personal opinions or views which, as an expression of a
person’s thinking, are necessarily closely linked to that person.
In the second place, the Court of Justice has confirmed that the General Court was correct in so far as it held that
pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for the
purposes of the application of Regulation 2018/1725. It follows from the provisions of that regulation as interpreted
in case-law that pseudonymisation may, depending on the circumstances of the case, effectively prevent persons
other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is
no longer identifiable. In that context, the Court of Justice is careful to recall the guidance from its case-law
regarding the assessment of whether or not the data subject is identifiable in situations in which the information
enabling that subject to be identified was not in the hands of other people.
Communications Directorate
Press and Information Unit
curia.europa.eu
In the third place, the Court of Justice has found that the General Court erred in law in holding that, in order to
assess whether the SRB had complied with its obligation to provide information, the EDPS should have examined
whether the comments transmitted to Deloitte constituted, from Deloitte’s point of view, personal data. According
to the Court of Justice, it is clear from case-law that the relevant perspective for assessing the identifiable
nature of the data subject depends, in essence, on the circumstances of the processing of the data in each
individual case. With regard to that obligation to provide information, the Court of Justice notes that that obligation
is part of the legal relationship between the data subject and the controller and, therefore, it concerns the
information in relation to that data subject as it was transmitted to that controller, thus before any potential
transfer to a third party. Accordingly, the Court of Justice has found that the identifiable nature of the data
subject must be assessed at the time of collection of the data and from the point of view of the controller.
The SRB’s obligation to provide information was applicable prior to the transfer of the data at issue and irrespective
of whether or not those data were personal data, from Deloitte’s point of view, after any potential
pseudonymisation.
NOTE: An appeal, on a point or points of law only, may be brought before the Court of Justice against a judgment or
order of the General Court. In principle, the appeal does not have suspensive effect. If the appeal is admissible and
well founded, the Court of Justice sets aside the judgment of the General Court. Where the state of the proceedings
so permits, the Court of Justice may itself give final judgment in the case. Otherwise, it refers the case back to the
General Court, which is bound by the decision given by the Court of Justice on the appeal.
Unofficial document for media use, not binding on the Court of Justice.
The full text and, as the case may be, the abstract of the judgment is published on the CURIA website on the day of
delivery.
Stay Connected!
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to
the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing
Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
Judgment of the General Court of 26 April 2023, SRB v EDPS, T-557/20.
Communications Directorate