A New Face For Pseudonymization

In a long-awaited decision of September 4, 2025¹ (Case C-413/23 P), the Court of Justice of the European Union provided an unprecedented clarification of the concept of "pseudonymized" data.

The case originated in a procedure initiated by the Single Resolution Council (CRU) against the Spanish bank Banco Popular Español. As part of this procedure, the CRU forwarded to a third party, Deloitte, comments written by shareholders, in pseudonymized form. When the matter was referred to the European Data Protection Supervisor (EDPS), he considered that Deloitte should have been mentioned as the recipient of the data, taking the view that pseudonymization did not cause the information to lose its personal character.