The conclusions of Advocate General Dean Spielmann in Case C-413/23 P (EDPS v. SRB), presented on 6 February 2025, address a crucial issue in the field of personal data protection: the qualification of pseudonymised data as personal data and their consequent inclusion under the GDPR protection regime.
Two interpretative approaches compared
The aforementioned conclusions highlight the existence of two distinct interpretative approaches in determining the legal status of pseudonymised data and, consequently, their inclusion within the scope of the GDPR.
The first approach argues that pseudonymised data should always be considered personal databecause data subjects remain identifiable, regardless of whether the entity using the data actually has access to the additional information that enables the attribution of personal data to a specific individual.
The second approach, on the other hand, states that pseudonymised data retain their nature as personal data only for those who can reasonably identify the data subjects. According to this line of interpretation, data cease to be considered personal data when, citing recital 26 of the GDPR, they are made sufficiently anonymous in the specific context of the processing to prevent or no longer allow the data subject to be identified.
A context-based criterion
This latter approach appears more consistent with the architecture of the GDPR and a pragmatic interpretation of the Regulation, introducing a context-based criterion that requires a concrete analysis of the processing circumstances.
Specifically, this approach assigns data controllers the responsibility of assessing whether there is a “reasonable probability” that re-identification techniques could be used to identify the data subject. Such an assessment must take into account the purposes and specific modalities of the processing, the technical and organizational measures adopted, and the particular circumstances of data sharing.
Implications for scientific research and the sharing of health data
This debate has significant implications for the management and accessibility of health and genomic data, particularly in the contexts of scientific research and biobanks.
An excessively broad classification of pseudonymized data as always subject to the GDPR, even in the absence of a concrete risk of re-identification, could introduce disproportionate burdens and restrictions, hindering data sharing and collaborations in the scientific and healthcare sectors.
At the same time, in this field, it is crucial to ensure that data processing is carried out in full compliance with the rights of data subjects, preventing re-identification risks and potential regulatory violations.
It now remains to be seen what the orientation of the Court of Justice of the European Union (CJEU) will be and how this will affect the future of data governance in Europe.
