Major Contributions By The CJEU On The Concepts Of Pseudonymisation And Personal Data

In a judgment dated September 4th, 2025 ¹ , the Court of Justice of the European Union (CJEU) provided major clarifications regarding the concept of personal data.

In this case, the Court was asked to rule, in particular, on the qualification, in terms of the definition of personal data, of comments made by individuals to a controller (the Single Resolution Board – SRB) and then communicated to a recipient (Deloitte). In this case, these comments had been pseudonymised prior to being communicated, which meant that Deloitte was unable to re-identify their authors.

In order to rule on the qualification of the data transmitted to Deloitte, the CJEU mentioned, in particular, the following points :