As organisations accelerate efforts to deploy AI, access to
\nlarge volumes of training data has become essential to maintaining
\na competitive edge. But this raises a fundamental legal question;
\nin the context of the GDPR, how far can businesses go when using
\ndatasets that appear de-identified or pseudonymised,
\nparticularly when training AI models?<\/p>\n
On 4 September 2025, the Court of Justice of the European Union
This represents a departure from earlier assumptions (at least,
This position is likely to benefit organisations training AI
The key takeaway from the judgment is that pseudonymised data
Legal backdrop<\/p>\n As a reminder, personal data is defined under the GDPR
CJEU case law and subsequent guidance from the European Data
For data to be anonymised and fall outside the scope of the
Pseudonymised data falls somewhere in between personal\/anonymous
Working out whether data is pseudonymised or fully anonymised is
So how does the EDPS case help us DP
Background<\/p>\n
We provided an initial summary of the GC’s judgement shortly
So, what happened here?<\/p>\n The CJEU disagreed in part with the GC’s reasoning,
The CJEU did uphold the GC’s finding that the
“Pseudonymisation may, depending on the circumstances
Therefore, even where the sender of the pseudonymised data
That said, the judgement confirmed that transparency obligations
EU vs UK: a convergence, but not (yet) a
This decision very much moves the European position closer to
\n(“CJEU”) issued its judgement<\/a> in European Data Protection
\nSupervisor (“EDPS”) v Single Resolution
\nBoard (“SRB”), which introduces a
\npotentially significant shift to how this question should be
\nanswered. It suggests that in some cases, certain pseudonymised
\ndata may fall outside the scope of the GDPR, depending on the
\nrecipient’s perspective and who holds the means to re-identify
\nthe individuals concerned.<\/p>\n
\nat a European level) that such data is personal whenever
\nany party holds the key, which supports a more contextual,
\nrelative (and practical) approach to identifiability, which is more
\nin line with the ICO’s approach to this topic in the UK (and
\nthe ICO has relied on the CJEU’s judgement in its appeal<\/a> against an Upper Tribunal ruling before
\nthe Court of Appeal). This shift also arguably aligns with the
\nEU’s broader digital strategy to facilitate responsible data
\nsharing.<\/p>\n
\nmodels, particularly where they receive large datasets from third
\nparties, as it supports the argument in some scenarios that such
\ndata may fall outside the scope of the GDPR, provided that the
\norganisation lacks the means to re-identify individuals.<\/p>\n
\nmay not be considered personal data for a particular recipient,
\ndepending on that party’s ability to re-identify
\nindividuals.<\/p>\n
\n– that is, information relating to an identified or identifiable
\nindividual.<\/p>\n
\nProtection Board (“EDPB”) has further
\nclarified that data can be personal if any party even a
\nthird party holds the means to re-identify individuals (and is
\nreasonably likely to use those means).<\/p>\n
\nGDPR, it must be processed in such a way that individuals are no
\nlonger identifiable, taking account of all the means
\n‘reasonably likely to be used’ by anyone to identify
\nthem.<\/p>\n
\ndata: it does not directly identify someone (so is often confused
\nwith anonymous data) but if it can still it can be attributed to an
\nindividual using additional information. For example, an online
\nretailer replacing customer names with customer numbers while
\nkeeping a separate list that links each number back to the real
\ncustomer will still be treated as personal data for purposes of the
\nGDPR, as it will not be considered fully anonymised.<\/p>\n
\nalso problematic for organisations with some experts considering
\nthat total anonymisation is hard to achieve.<\/p>\n
\npractitioners?<\/p>\n
\nIn 2017, the European Central Bank announced that Banco Popular
\nEspa\u00f1ol was failing.
\n
\nSRB (an institution set up as part of European measures to
\nregulate banks following the Eurozone crisis) then issued a
\nresolution decision (before deciding on potential compensation for
\naffected shareholders\/creditors).
\n
\nAs part of its process, the SRB collected comments from
\naffected individuals, which included survey-style comments,
\npseudonymised that data and then shared it with Deloitte.
\n
\nSRB tagged each comment with an alphanumeric code (i.e., the
\n‘key’ to the data) and removed directly identifiable data
\nprior to sharing the data with Deloitte. In other words, SRB had
\nthe ability to re-identify individuals to whom the comments related
\nvia the key, whereas Deloitte did not.
\n
\nSeveral individuals lodged complaints with the EDPS, arguing
\nthat SRB failed to name Deloitte as a recipient of personal data,
\ncontrary to its transparency obligations under Article 15 EUI GDPR
\n(i.e., the version of the GDPR that applies to EU
\ninstitutions).
\n
\nThe EDPS concluded that the data shared with Deloitte was
\npseudonymous (and personal) data, on the basis that SRB could
\nre-identify individuals. Subsequently, SRB was in breach of its
\ntransparency obligations.
\n
\nSRB successfully challenged the EDPS’ decision at the
\nGeneral Court (“GC”). The GC annulled
\nthe EDPS’ decision that the data was pseudonymous (and
\npersonal) on several grounds, including:
\n
\n
\nIt failed to properly apply the ‘content, purpose, and
\neffect’ test (applied from previous case law, which requires an
\nassessment of whether the information, by its content, the purpose
\nfor which it is processed, or its effects, relates to an identified
\nor identifiable individuals, rather than assuming that data
\nnecessarily relates to individuals merely because it concerns their
\nviews or opinions; and
\n
\nWrongly held that the question of whether the data was
\nidentifiable must be assessed from the perspective of Deloitte (and
\nas Deloitte did not hold that key to that data, it therefore
\nfollows that Deloitte was not a recipient of personal data).
\n
\n
<\/p>\n
\nafter its publication, with further analysis available here<\/a>.<\/p>\n
\nparticularly in relation to how the EDPS assessed whether the data
\nin question related to identifiable individuals. Drawing on the
\nNowak judgement, the Court confirmed that “the particular
\nnature of personal opinions or views [are] as an expression of a
\nperson’s thinking… necessarily closely linked to that
\nperson” As such, the EDPS was entitled to conclude that
\nthe comments provided by affected individuals related to those
\nindividuals, without needing to apply the ‘content, purpose and
\neffect’ test.<\/p>\n
\nidentifiability of data must be assessed from the perspective of
\nthe recipient, stating that:<\/p>\n
\nof the case, effectively prevent persons other than the controller
\nfrom identifying the data subject, in such a way that, for them,
\nthe data subject is not or is no longer identifiable.” [para
\n86]<\/p>\n
\n(here, the SRB) holds the key to re-identify that data, that same
\ndata may be anonymous to the recipient.<\/p>\n
\nunder the GDPR still applied. The SRB retained the ability to
\nre-identify individuals and therefore remained a controller of
\npersonal data. As such, it was required to name Deloitte as a
\nrecipient under its transparency obligations, even though Deloitte
\nreceived only de-identified data from its own standpoint.<\/p>\n
\nmerger<\/p>\n
\nthe UK position. To date, previous European case law provided a
\nlong\u2011standing orthodoxy, suggesting that pseudonymous data
\nremained personal data so long as anyone, anywhere, held the key
\n(having regard to the means ‘reasonably likely to be
\nused’).<\/p>\n