Recent European Court Judgements

• Court of Justice:

Case C-413/23 P: EDPS v SRB (Notion de données à caractère personnel)- 2025.09.04

• The case centered on the definition of "personal data" in the context of pseudonymized information and the transparency obligations of data controllers under EU  data protection law.

Facts of the Case:

• The case originated from the 2017 resolution of Banco Popular Español, where the Single Resolution Board (SRB) initiated a "right to be heard" process for shareholders and creditors. Individuals submitted comments after registering, and the SRB subsequently hired the consulting firm Deloitte to analyze them. To protect the individuals' identities, the SRB pseudonymized the comments by assigning a unique alphanumeric code to each and removing direct identifying information before transferring the data to Deloitte. Crucially, the SRB retained the "key" that could re-identify the individuals, allowing them to link the codes back to the original