Author: Sarah Smith

The CJEU judgment of 4 September 2025 clarifies the scope of the concept of “personal data.” The Court held that information relates to an individual where it is linked to a data subject by its content, purpose, or effect. It also acknowledged that pseudonymised data may not constitute personal data for a recipient who is not in a position to identify the data subjects. Finally, the CJEU reiterated that the obligation to provide information applies to the data controller when individuals are identifiable, but not to a third party who is unable to identify them.

In its judgment of 4 September 2025 (Case C-413/23 P), the Court of Justice of the European Union (CJEU) provided important clarifications regarding the scope of the notion of “personal data” within the meaning of Regulation (EU) 2018/1725—that is, the regulation analogous to the GDPR, governing the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices, and agencies.

The Facts

The case concerns a Spanish bank that underwent a restructuring process. For that purpose, the Single Resolution Board (SRB) sought the opinions of former shareholders and creditors. The responses submitted anonymously were transmitted to an external company for analysis. However, it appeared that the individuals who had provided their opinions had not been informed by the SRB of this use of their data and of the disclosure of their responses to third parties.

The Procedure

Some of the data subjects lodged a complaint with the European Data Protection Supervisor (EDPS), who found that the SRB had failed to comply with its information obligations under Regulation (EU) 2018/1725. The SRB challenged this finding before the General Court, which overturned the EDPS’s decision. The EDPS subsequently lodged an appeal before the Court of Justice of the European Union (CJEU).

The CJEU’s Decision: Three Key lessons

More than six years after the entry into application of the GDPR, the CJEU issued a notable judgment clarifying the concept of “personal data”.

• First, the CJEU held that information “relates to” a data subject if it is linked to that person by one of three criteria: its content, its purpose, or its effect. Given the “particular nature of personal opinions or views which, as an expression of a person’s thinking, are necessarily closely linked to that person” (the content criterion), the Court found that it was not necessary, in this case, to examine the other criteria to conclude that the comments in question are personal data.
• Second, while it was generally accepted that pseudonymised data remains personal data in all circumstances, the CJEU refined this assumption. The Court thereby recognises a conceptual distinction according to which, although the initial data controller is still able to re-identify the data subjects, if the recipient does not have this ability, the data are not, from the recipient’s point of view, personal data.
• Third, regarding the SRB’s obligation to inform the data subjects of the transfer of their pseudonymised data to a third party, the CJEU emphasised that this obligation must be assessed within the relationship between the SRB and the data subjects, that is prior to any disclosure to a third party. Since, at that stage, the data subjects were identifiable, the SRB was required to comply with its information obligation. On the other hand, a third party who does not have reasonable means of identifying the data subjects is not subject to such an obligation.

This judgment is therefore significant because it clarifies the notion of personal data and acknowledges that pseudonymised data may, in certain circumstances, not be concerned the scope of the GDPR.

See more articles from our member firm in Belgium, Philippe & Partners.

For the first time, an agreement between the EU and the US on the transfer of personal data has withstood judicial scrutiny by the European courts. The judgment in Latombe v. European Commission (General Court of the European Union, 3 September 2025) confirms that the EU–US Data Privacy Framework (DPF) ensures an adequate level of protection, as required under the EU’s General Data Protection Regulation (GDPR).

With the safeguards now in place under US law, European companies can continue to use American cloud and IT services with greater peace of mind. Or should caution still prevail?

Transfer of personal data between the EU and the US

Since 2018, the GDPR has aimed to guarantee a high and uniform level of data protection within the European Economic Area (EEA). However, many companies operate outside this area or do business with entities established abroad, resulting in the processing of personal data outside the EEA.

Such transfers are in principle only permitted where adequate data protection can be ensured through one of the mechanisms provided for under the GDPR. An adequacy decision adopted by the European Commission, declaring that a non-EEA country ensures an adequate level of protection, is one such mechanism.

Given their shared commercial interests, the EU and the United States have long sought to establish a regulatory framework that meets the stringent requirements of the GDPR. Yet repeated surveillance scandals and the lack of independent oversight in the US have proven major stumbling blocks.

The 2000 Safe Harbour Agreement was invalidated by the Court of Justice in its Schrems I judgment (2015), and the 2016 Privacy Shield met the same fate in its Schrems II judgment (2020). In both cases, the Court found that US intelligence services had overly broad powers and that EU citizens lacked sufficient judicial redress against disproportionate interference.

Following these rulings, negotiations resumed with the US to create a new framework that would comply with both the GDPR and the EU Charter of Fundamental Rights. This led to Commission Implementing Decision (EU) 2023/1795, which endorsed the EU–US Data Privacy Framework — a self-certification system under which US companies that have self-certified under the DPF must comply with the principles, rules and obligations governing the processing of personal data of individuals in the EEA.

The framework introduces new safeguards for the processing of personal data by US intelligence authorities and establishes the Data Protection Review Court (DPRC).

The case Latombe v. European Commission

Shortly after the DPF entered into force, French Member of the European Parliament Philippe Latombe brought an action before the General Court seeking annulment of the adequacy decision. He argued that the European Commission had exceeded its margin of discretion by determining that the United States ensured an adequate level of protection.

Latombe maintained that, even with the new guarantees introduced, the US legal system still failed to provide sufficient safeguards for key GDPR requirements — in particular with respect to (1) effective judicial redress, (2) interference by intelligence services, (3) automated decision-making, and (4) security of processing of personal data.

He further claimed that, in assessing the DPF, the Commission had failed to take adequate account of the Schrems I and Schrems II case-law, and that the new framework still suffered from essentially the same deficiencies.

The judgment of 3 September 2025

The General Court, however, dismissed all of Latombe’s pleas and upheld the validity of the DPF.

• Right to an effective remedy (Article 47 of the Charter)

The Court held that the DPRC is functionally independent and protected from undue influence. Although its members are appointed and removed by the executive branch, they enjoy sufficient safeguards. The fact that the DPRC is not part of the judiciary is acceptable, as its guarantees are equivalent and its decisions are binding and final on the US government and intelligence agencies.

• Interference by intelligence services (Articles 7 and 8 of the Charter)

Latombe argued that US law still allows for intelligence agencies to collect personal data in bulk without prior judicial or administrative authorisation. The Court rejected this argument, finding that indiscriminate or mass collection of data is not permitted in the US. Bulk collection is allowed only when targeted collection is not feasible and must be limited, necessary and proportionate, subject to subsequent review by an independent body.

• Automated decision-making (Article 22 GDPR)

Unlike the GDPR, US law does not contain a general prohibition on purely automated decision-making without human intervention. The applicable rules differ across sectors and types of organisations. Nonetheless, the Court found that the US framework provides adequate protection, as the DPF imposes transparency obligations on organisations and grants individuals the right to request human review of an automated decision. In addition, oversight mechanisms are in place to handle complaints from individuals.

• Security of processing (Article 32 GDPR)

Whereas the GDPR imposes a general obligation to ensure the security of personal data, this obligation in the US applies only to organisations that have formally adhered to the DPF. The Court found that the Commission had sufficiently assessed whether the US certification system offers adequate protection. Since certified organisations are contractually bound to implement appropriate security measures and are subject to supervision by the US authorities, the Court held that an equivalent level of protection is ensured.

The Court consistently emphasised that the US system does not need to be identical to the GDPR, provided that the level of protection is “essentially equivalent” in practice. Although the DPF currently stands, its future remains uncertain, nonetheless.

In addition to a possible appeal that Latombe may bring against this judgment, several privacy-rights organisations — including NOYB (None of Your Business), founded by Max Schrems — have already announced their intention to challenge the DPF on broader grounds through both administrative and judicial channels.

Finally, adequacy decisions such as the DPF are subject to periodic review every four years. The first review will therefore take place by 2027 at the latest. The European Commission will then need to assess whether the US continues to uphold the promised safeguards. In today’s unpredictable political climate of trade tensions and shifting policies, that remains to be seen.

See more articles from our member firm in Belgium, Philippe & Partners.