GDPR and Cybersecurity: A Practical Guide to Article 32, DPIA, Encryption and Breach Response
A practical GDPR security guide: Article 32 controls, DPIA, encryption standards, MFA, backups and the 72-hour breach procedure for CISOs and DPOs.
Regulations
CJEU Ruling on Pseudonymized Data: What It Means for GDPR Compliance
The EU Court of Justice ruled that pseudonymized data remains personal data under GDPR when the controller can still re-identify the individuals.
A Landmark CJEU Ruling on Data Protection
The Court of Justice of the European Union (CJEU) has issued a significant ruling that clarifies when pseudonymized data counts as personal data. The case involved the Single Resolution Board (SRB), which shared pseudonymized data about shareholders and creditors of Banco Popular Español with Deloitte.
Pseudonymization Is Not Anonymization
The CJEU found that the SRB had violated data protection rules. The data it shared did not include direct identifiers such as first and last names, but it still counted as personal data. The deciding factor was that the SRB held additional information that let it link the data back to specific, identified individuals.
The Court stressed that pseudonymization is only a safeguard. It does not strip data of its "personal" character as long as the controller holds the "key" needed to re-identify the individuals.
The Duty to Inform
The CJEU also held that the shareholders' opinions and comments are personal data as well. The SRB was required to tell the people whose data it collected about every potential recipient of that data, which in this case included Deloitte. It did not do so.
The case now returns to the EU General Court, which will examine the remaining claims.
See also: The NIS2 Directive: What You Need to Know and ISO 27001: The Information Security Standard.
