- The ECJ does not generally consider pseudonymized data to be personal data; if third parties are not able to remove the pseudonymization, data subjects remain unidentifiable to them.
- The controller’s obligation to provide information must be checked at the time of data collection; it does not apply if it is unlikely that recipients will be able to process the data as personal data at the time of collection.
The ECJ ruled on September 4, 2025 (Rs. C‑413/23) that a disclosure of pseudonymous data does not constitute a disclosure of personal data if
The background to this was a decision by the Single Resolution Board SRBa European Banking Union authority responsible for resolution, which had initiated resolution proceedings against a bank. In this context, statements were obtained from shareholders and creditors. These were later transmitted to Deloitte in pseudonymized form:
28 Only those opinions were submitted to Deloitte that […] were associated with a alphanumeric code were provided. However, only the SRB could use this code to link the opinions to the data collected during the registration phase […]. […] Deloitte had no access to the database with the data collected during the registration phase […].
It was disputed whether the affected shareholders and creditors should have been informed about the disclosure to Deloitte, and therefore in particular whether this was a disclosure of personal data.
The ECJ answers this question in the negative: Pseudonymized data is not personal under all circumstances. If a third party cannot remove the pseudonymization, the data subjects are for this not identifiable.
This judgment is correct because it results from the relative approach in determining the personal reference: It depends on the identification possibilities of the body that processes data or has it processed by a processor. A direct consequence of this is the fact that pseudonymization can have the same effect as anonymization vis-à-vis third parties, which is why pseudonymization could also be referred to as subjective anonymization. In Switzerland, the HGer Zurich 2021 decided immediately.
This means, for example, that when disclosing robustly pseudonymized data to a processor abroad neither an ADV nor the SCC necessary are. However, the controller may be required to ensure confidentiality and purpose limitation with the recipient under the heading of data security and therefore conclude a quasi DPA.
Test criteria for the personal reference
The concept of personal data depends on whether a piece of information
55 […] due to their Contentstheir For the purpose of or their Effects is linked to an identifiable person (judgments of December 20, 2017, Nowak, C‑434/16 […], OC v Commission, C‑479/22 […], IAB Europe, C‑604/22 […] and the case law cited therein).
However, it is not always necessary to check the purpose and effects of processing separately:
56 […] […] According to the case-law cited in paragraph 55 of the present judgment, an examination of the content of an information not necessarily complemented by an analysis of their purpose and impact become. This results from the use of the conjunction “or”, with which the various criteria mentioned in this case law were linked.
Personal reference of pseudonymized data
Initially, pseudonymization is merely a Measurewhich lowers the probability of identification, and is not included in the legal definition of personal data:
72 As stated by the Advocate General […], pseudonymization is therefore not an element of the definition of ‘personal data’. Rather, it refers to the implementation of technical and organizational measures intended to reduce the risk that a particular set of data is associated with the identity of the data subjects. […]
And if this measure leads to a person being de facto no longer identifiable the personal reference is missing:
75 If such technical and organizational measures are actually taken and are suitable to prevent the data in question from being assigned to the data subject, so that the data subject is not or no longer identifiable, the pseudonymization may have an effect on the personal nature of these data within the meaning of Art. 3 No. 1 of Regulation 2018/1725.
For this reason, the employees transmitted Pseudonyms are not personal data per se:
77 With regard to Deloitte, to which the SRB has transmitted pseudonymized opinions, […] the technical and organizational measures […] can have the effect that these opinions are not personal for Deloitte. However, this presupposes on the one hand that Deloitte is not in a position to revoke these measures when processing the opinions under its control. On the other hand, these measures must also actually be suitable for preventing Deloitte from assigning these comments to the person concerned, including by other means of identification, such as a comparison with other elements, so that the person concerned is not or no longer identifiable for Deloitte.
This result is in line with case law:
82 Furthermore, the Court has already ruled that a means is not likely to be used to identify the person concerned if the risk of identification appears de facto insignificant because the Identification of this person is prohibited by law or impracticable e.g. because it would require a disproportionate amount of time, cost and labor […]. […]
83 Similarly, the Court […] essentially ruled that non-personal data per se collected and stored by the controller nevertheless related to an identifiable person, as the controller had legal means to obtain additional information from third parties that allowed that person to be identified. […].
84 In particular, according to case law […] data which are not in themselves personal can become “personal” data if the controller provides them to other persons who have means which, according to common judgment, are likely to allow the identification of the data subject. […]
85 […] Unless […] it can be excluded that these third parties are reasonably able to associate the pseudonymized data with the data subject by means such as a comparison with other data at their disposal, this person is to be considered identifiable both in relation to the transmission of the data and in relation to the subsequent processing of these data by third parties. In such circumstances, pseudonymized data would have to be considered as personal data.
86 Consequently, […] pseudonymized data must […] not considered personal data in every case and for every person become. This is because pseudonymization can – depending on the circumstances of the individual case – actually prevent persons other than the controller from identifying the data subject, so that the latter is not or no longer identifiable to them.
Effects on the duty to inform
It was also disputed to what point in time the obligation to provide information about the recipients should be applied. Here it comes does not depend on whether a potential subsequent recipient can make an identification:
112 It follows […] that the SRB’s duty to provide information in the present case prior to the transmission of the opinions in question and regardless of thiswhether or not it was personal data from Deloitte’s point of view after pseudonymization.
113 […] It is clear from paragraphs 102 to 108 of the present judgment […] that that provision governs the duty to provide information incumbent on the controller. at the time of collection of such data. The question of whether the controller has fulfilled its duty to inform at that time cannot depend on the means of identifying the data subject which a potential recipient might have at his or her disposal after a subsequent transfer of the data in question.
114 As stated by the Advocate General […], the argument […] that the perspective of the recipient should be taken in order to verify compliance with this information obligation would lead to a temporal shift of this control. Since this control would necessarily concern personal data already transmitted to the recipient, this argument also disregards the The purpose of the information obligation, which is inextricably linked to the relationship between the controller and the data subject is.
This conclusion is plausible – but only if, at the time the data is collected, it is at least to be expected that data will be disclosed to a recipient that is effectively personal to that recipient. If this is not to be expected, e.g. because it is clear that data is only to be passed on in pseudonymized form, no obligation to provide information can arise because the corresponding process is not relevant to data protection and therefore cannot have any consequences under data protection law.