Data Pseudonymization: AG Speilmann's Opinion On The EDPS v SRB

Data Pseudonymization

In our previous article, EU Court Clarifies When Pseudonymized Data Does Not Remain Personal Data, we discussed the General Court's judgment in Case T-557/20, where it ruled that pseudonymized data may not be considered personal data if the recipient cannot re-identify the data subjects. The case arose from the Single Resolution Board ("SRB") transmitting data to Deloitte without informing affected data subjects, leading to complaints and an investigation by the European Data Protection Supervisor ("EDPS").

Following the General Court's ruling in favour of the SRB, the EDPS appealed the decision, leading to an Opinion by Advocate General Dean Spielmann (the "AG") prior to the court's decision being issued. This article thus aims to summarise Spielmann's Opinion and its implications for the interpretation of data protection obligations.