Let's see how we can help you!
Leave a message and our dedicated advisor will contact you.
Send us a message
0/10000
CJEU on Data Pseudonymization: A Key GDPR Ruling
Published: 00:00 09/14/2025
Regulacje
Key CJEU Ruling on Data Protection
The Court of Justice of the European Union (CJEU) has issued a significant ruling that clarifies the understanding of personal data in the context of pseudonymization. The case involved the Single Resolution Board (SRB), which had provided pseudonymized data of shareholders and creditors of the bank Banco Popular Español to the firm Deloitte.
Pseudonymization Is Not Anonymization
The CJEU found that the SRB had violated data protection regulations. Although the transferred data did not contain direct identifiers such as names, it was still considered personal data. The key factor was that the SRB possessed additional information that made it possible to attribute the data to specific, identified individuals.
The Court emphasized that pseudonymization is merely a security measure and does not strip data of its "personal" character if the controller has the "key" to re-identify it.
The Information Obligation
Additionally, the CJEU stated that the opinions and comments of shareholders also constitute personal data. The SRB was obligated to inform the individuals whose data it collected about all potential recipients of that data (in this case, Deloitte), which it failed to do.
The case now returns to the EU General Court for further examination of the remaining claims.
About the Author
Aleksander Zębrowski
Chief Technology Officer at SecurHub.pl
PhD candidate in neuroscience. Psychologist and IT expert specializing in cybersecurity.
Related Articles
![NIS2 2025: Avoid Fines Up to €10M [Complete Implementation Guide]](/_next/image?url=https%3A%2F%2Fimages.unsplash.com%2Fphoto-1608817576203-3c27ed168bd2&w=3840&q=75)
Regulacje
NIS2 2025: Avoid Fines Up to €10M [Complete Implementation Guide]
⚠️ October 18, 2024 - NIS2 implementation deadline passed. If your company is not compliant, you risk fines up to €10 million. Check obligations, critical deadlines, and step-by-step implementation plan. [2025]
11.10.2025
18 min
Regulacje
EU Introduces the Data Act. The End of the "Digital Prison" for IoT Devices
As of September 12, 2025, the new rules of the EU Data Act are in force. The regulation aims to give users more control over data from IoT devices and make it easier to switch cloud providers.
15.09.2025
4 min
![ISO 27001 Certification: How to Achieve in 6-12 Months [Process + Costs 2025]](/_next/image?url=https%3A%2F%2Fimages.unsplash.com%2Fphoto-1502101872923-d48509bff386&w=3840&q=75)
Regulacje
ISO 27001 Certification: How to Achieve in 6-12 Months [Process + Costs 2025]
ISO 27001 certificate is your ticket to tenders and client trust. Learn the step-by-step certification process, real costs (€10-50k), and 8 key controls you must implement. Guide for companies in Poland.
11.10.2025
13 min
Comments
Loading comments...