ECJ paves the way for analysis and evaluation of pseudonymised data
> September 2025
Provided that technical and organisational measures sufficiently ensure that data recipients cannot identify data subjects, there are no data protection restrictions preventing them from generating value from this data.... This applies even if the data exporter remains responsible and is able to identify individuals from the data. This appears to be the conclusion to be drawn from the recent ruling of the European Court of Justice (ECJ), which seems to loosen the criteria for considering data to be personal data.
The ECJ decision of 4 September 2025 (C‑413/23 P) relates to the resolution of Banco Popular Español SA by the Single Resolution Board of the European Union (SRB). The SRB conducted a consultation process via its website on whether shareholders and creditors of the bank should be compensated.
Participants had to register by presenting identification and proof of ownership of a Banco Popular Español SA capital instrument. Successfully registered participants were asked to submit a statement, each of which was assigned a randomly generated 33-digit alphanumeric code. The SRB then commissioned the auditing and advisory company Deloitte (Deloitte) to evaluate the comments submitted. Information that could have been used to identify individual participants via the assigned code (in particular the documents submitted during participant registration) was not disclosed to Deloitte.
Several individuals complained that the privacy policy provided on the SRB website did not list Deloitte as a possible recipient of personal data, which raised the question of whether the comments submitted constituted personal data for Deloitte.
The ECJ first clarified that the legal definition of ‘personal data’ in European data protection law does not include the concept of pseudonymisation. The only decisive factor is whether individuals to whom respective statements are linked are identified or identifiable. In this respect, however, pseudonymisation constitutes a technical and organisational measure to prevent data subjects from being identified solely on the basis of said pseudonymised data.
Since the SRB retained the documents submitted when the participants registered, the comments remained personal data for the SRB despite pseudonymisation. It should therefore have indeed informed data subjects of the data transfer to Deloitte. For Deloitte, however, the comments transmitted by the SRB were not personal data, as Deloitte was unable to identify the individual participants due to a lack of additional information. This conclusion is also consistent with previous ECJ case law, in particular the Breyer decision of 19 October 2016 (C‑582/14), in which the ECJ ruled for IP addresses that the only decisive factor in determining whether data is to be considered personal data for an entity is whether it has, with reasonable effort, legal means at its disposal that allow it to identify the individuals on the basis of additional information (see para. 44 et seq.).
While in that case data was considered personal data only because the relevant service provider had the option of contacting the competent authority in the event of cyber attacks so that the latter could obtain the information in question from the internet access provider and initiate criminal proceedings (see paragraph 47), in the this case, the ECJ fails to provide a compelling explanation as to why the data in question should not be considered personal data for the data recipient Deloitte. In particular, the ECJ does not elaborate on the fact that Deloitte could have obtained the additional information required for identification directly from its contractual partner.
The rigorous approach with which the ECJ has previously deemed data personal data appears to have faded. Whether the reasoning behind this is compelling remains to be assessed. In practice, however, generating value from personal data will be much easier based on this court decision. With sufficient technical and organisational measures and appropriate contractual safeguards, it will be reasonable to argue that a contracted service provider cannot identify data subjects and is therefore free to analyse respective data.
The decision offers extensive possibilities for pseudonymising and transferring personal data to third parties for the purpose of evaluation or other analysis. The decision is likely to bring considerable benefits, particularly in the field of artificial intelligence, where oftentimes only the statistical distribution of values in a data set, and not their reference to an individual, is relevant for system training.
