(Erratum: An earlier version of this article incorrectly stated that the CJEU ruled that all pseudonymised data must always be regarded as personal data. In fact, the Court clarified that this depends on the circumstances. However, it stressed that shareholders’ opinions and comments are, by their very nature, linked to their authors’ identity and therefore qualify as personal data. We apologise to our readers for this confusion.)
On Thursday, the Court of Justice of the EU held that pseudonymised comments submitted by Banco Popular shareholders and transmitted to Deloitte could still constitute personal data. The SRB should therefore have informed them of the transfer, thereby reaffirming a strong requirement in terms of data protection.
In 2017, the failure of Banco Popular Español led the Single Resolution Board (SRB) to place the bank under resolution. To assess the impact of this measure on shareholders and creditors, the SRB commissioned Deloitte and transmitted certain investor comments to it, in pseudonymised form. Several of the persons concerned, however, lodged complaints with the European Data Protection Supervisor (EDPS), arguing that they had not been informed of this transfer.
The EDPS agreed, finding that the comments did constitute personal data and that the SRB had breached its duty of information. In 2023, however, the General Court annulled that decision, considering that from Deloitte’s perspective the data was not necessarily personal.
The CJEU has now overturned that interpretation. It clarified that shareholders’ opinions and comments are, by their very nature, linked to their identity and therefore constitute personal data. At the same time, the Court confirmed that pseudonymised data should not always and in all circumstances be considered personal data: it depends on the context and, in particular, on who processes the data.
Finally, the CJEU underlined that the duty of information must be assessed at the time of collection by the SRB, and not from Deloitte’s perspective after pseudonymisation. The case is referred back to the General Court, which must draw the necessary conclusions.
This article was originally published in French.
