News

Philippe & Partners: The Court of Justice of the EU Clarifies the Notion of ‘Personal Data’

The CJEU judgment of 4 September 2025 clarifies the scope of the concept of “personal data.” The Court held that information relates to an individual where it is linked to a data subject by its content, purpose, or effect. It also acknowledged that pseudonymised data may not constitute personal data for a recipient who is not in a position to identify the data subjects. Finally, the CJEU reiterated that the obligation to provide information applies to the data controller when individuals are identifiable, but not to a third party who is unable to identify them.

In its judgment of 4 September 2025 (Case C-413/23 P), the Court of Justice of the European Union (CJEU) provided important clarifications regarding the scope of the notion of “personal data” within the meaning of Regulation (EU) 2018/1725—that is, the regulation analogous to the GDPR, governing the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices, and agencies.

The Facts

The case concerns a Spanish bank that underwent a restructuring process. For that purpose, the Single Resolution Board (SRB) sought the opinions of former shareholders and creditors. The responses submitted anonymously were transmitted to an external company for analysis. However, it appeared that the individuals who had provided their opinions had not been informed by the SRB of this use of their data and of the disclosure of their responses to third parties.

The Procedure

Some of the data subjects lodged a complaint with the European Data Protection Supervisor (EDPS), who found that the SRB had failed to comply with its information obligations under Regulation (EU) 2018/1725. The SRB challenged this finding before the General Court, which overturned the EDPS’s decision. The EDPS subsequently lodged an appeal before the Court of Justice of the European Union (CJEU).

The CJEU’s Decision: Three Key lessons

More than six years after the entry into application of the GDPR, the CJEU issued a notable judgment clarifying the concept of “personal data”.

• First, the CJEU held that information “relates to” a data subject if it is linked to that person by one of three criteria: its content, its purpose, or its effect. Given the “particular nature of personal opinions or views which, as an expression of a person’s thinking, are necessarily closely linked to that person” (the content criterion), the Court found that it was not necessary, in this case, to examine the other criteria to conclude that the comments in question are personal data.
• Second, while it was generally accepted that pseudonymised data remains personal data in all circumstances, the CJEU refined this assumption. The Court thereby recognises a conceptual distinction according to which, although the initial data controller is still able to re-identify the data subjects, if the recipient does not have this ability, the data are not, from the recipient's point of view, personal data.
• Third, regarding the SRB’s obligation to inform the data subjects of the transfer of their pseudonymised data to a third party, the CJEU emphasised that this obligation must be assessed within the relationship between the SRB and the data subjects, that is prior to any disclosure to a third party. Since, at that stage, the data subjects were identifiable, the SRB was required to comply with its information obligation. On the other hand, a third party who does not have reasonable means of identifying the data subjects is not subject to such an obligation.

This judgment is therefore significant because it clarifies the notion of personal data and acknowledges that pseudonymised data may, in certain circumstances, not be concerned the scope of the GDPR.

See more articles from our member firm in Belgium, Philippe & Partners.

Back to News

Next article