Introduction
The definition of "personal data1" is
fundamental to data protection law, but its scope remains a
frequent source of confusion. While the GDPR clearly applies to
personal data and excludes anonymous information, the regulatory
status of pseudonymous data has long been a significant point of
contention.
In its recent ruling, EDPS v SRB (Case C-413/23 P), the Court of
Justice of the European Union (CJEU) brought much-needed clarity
and addressed the conditions under which pseudonymised information
escapes the reach of GDPR rules.
The central lesson for any organisation utilising feedback or
external vendors is clear: data appearing anonymous is not
necessarily safe from GDPR scrutiny. The ruling confirms that
personal data status depends primarily on the controller's
possession of re-identification tools, rather than the format of
the data shared.
