{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-413-23-p-62023cj0413","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-413-23-p-62023cj0413)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-27","fingerprint":"ewai:eu:66a2b7","proof":"sha256:bef909adc6b43f582c4867c7bb5dbf3918c8acbd1820bad20b73b0f8c0641d80","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-413-23-p-62023cj0413","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62023CJ0413","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (First Chamber)","paragraphs":[]},{"title":"4 September 2025 (\n *1\n )","paragraphs":["para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_27"]},{"title":"I.   Legal context","paragraphs":[]},{"title":"2","paragraphs":["para_30","para_31","para_32","para_33"]},{"title":"(16)","paragraphs":["para_35"]},{"title":"(17)","paragraphs":["para_37","para_38"]},{"title":"(35)","paragraphs":["para_40"]},{"title":"3","paragraphs":[]},{"title":"Article 3(1), (6), (8) and (13) of Regulation 2018/1725, headed ‘Definitions’, provides:","paragraphs":["para_43"]},{"title":"(1)","paragraphs":["para_45","para_46"]},{"title":"(6)","paragraphs":["para_48","para_49"]},{"title":"(8)","paragraphs":["para_51","para_52"]},{"title":"(13)","paragraphs":["para_54"]},{"title":"4","paragraphs":["para_56","para_57"]},{"title":"5","paragraphs":["para_59","para_60"]},{"title":"6","paragraphs":["para_62","para_63","para_64"]},{"title":"(d)","paragraphs":["para_66","para_67","para_68"]},{"title":"(a)","paragraphs":["para_70"]},{"title":"(b)","paragraphs":["para_72","para_73"]},{"title":"(e)","paragraphs":["para_75","para_76"]},{"title":"7","paragraphs":["para_78"]},{"title":"8","paragraphs":["para_80","para_81"]},{"title":"II.   Background to the dispute","paragraphs":[]},{"title":"9","paragraphs":["para_84"]},{"title":"10","paragraphs":["para_86"]},{"title":"11","paragraphs":["para_88"]},{"title":"12","paragraphs":["para_90"]},{"title":"13","paragraphs":["para_92"]},{"title":"14","paragraphs":["para_94"]},{"title":"15","paragraphs":["para_96"]},{"title":"A.   The right to be heard process","paragraphs":[]},{"title":"16","paragraphs":["para_99"]},{"title":"17","paragraphs":["para_101"]},{"title":"18","paragraphs":["para_103"]},{"title":"19","paragraphs":["para_105"]},{"title":"20","paragraphs":["para_107"]},{"title":"21","paragraphs":["para_109","para_110"]},{"title":"22","paragraphs":["para_112"]},{"title":"23","paragraphs":["para_114"]},{"title":"24","paragraphs":["para_116"]},{"title":"25","paragraphs":["para_118"]},{"title":"26","paragraphs":["para_120"]},{"title":"27","paragraphs":["para_122"]},{"title":"28","paragraphs":["para_124"]},{"title":"C.   The procedure before the EDPS","paragraphs":[]},{"title":"29","paragraphs":["para_127"]},{"title":"30","paragraphs":["para_129"]},{"title":"31","paragraphs":["para_131"]},{"title":"32","paragraphs":["para_133"]},{"title":"33","paragraphs":["para_135"]},{"title":"34","paragraphs":[]},{"title":"By that decision, the EDPS revised the initial decision in the following terms:","paragraphs":["para_138","para_139","para_140","para_141","para_142","para_143","para_144","para_145"]},{"title":"III.   The procedure before the General Court and the judgment under appeal","paragraphs":[]},{"title":"35","paragraphs":["para_148"]},{"title":"36","paragraphs":["para_150"]},{"title":"37","paragraphs":["para_152"]},{"title":"38","paragraphs":["para_154"]},{"title":"IV.   Procedure before the Court and forms of order sought","paragraphs":[]},{"title":"39","paragraphs":["para_157"]},{"title":"40","paragraphs":[]},{"title":"The EDPS, supported by the European Data Protection Board, asks the Court to:","paragraphs":["para_160","para_161","para_162","para_163","para_164","para_165"]},{"title":"41","paragraphs":[]},{"title":"The SRB, supported by the Commission, contends that the Court should:","paragraphs":["para_168","para_169","para_170","para_171","para_172","para_173","para_174","para_175"]},{"title":"V.   The appeal","paragraphs":[]},{"title":"42","paragraphs":["para_178"]},{"title":"A.   The first ground of appeal","paragraphs":[]},{"title":"43","paragraphs":["para_181","para_182"]},{"title":"(a)\n  \n Arguments of the parties","paragraphs":[]},{"title":"44","paragraphs":["para_185"]},{"title":"45","paragraphs":["para_187"]},{"title":"46","paragraphs":["para_189"]},{"title":"47","paragraphs":["para_191"]},{"title":"48","paragraphs":["para_193"]},{"title":"49","paragraphs":["para_195"]},{"title":"50","paragraphs":["para_197"]},{"title":"51","paragraphs":["para_199"]},{"title":"(b)\n  \n Findings of the Court","paragraphs":[]},{"title":"52","paragraphs":["para_202"]},{"title":"53","paragraphs":["para_204"]},{"title":"54","paragraphs":["para_206"]},{"title":"55","paragraphs":["para_208"]},{"title":"56","paragraphs":["para_210"]},{"title":"57","paragraphs":["para_212"]},{"title":"58","paragraphs":["para_214"]},{"title":"59","paragraphs":["para_216"]},{"title":"60","paragraphs":["para_218"]},{"title":"61","paragraphs":["para_220","para_221"]},{"title":"62","paragraphs":["para_223"]},{"title":"(a)\n  \n The first complaint in the second part of the first ground of appeal","paragraphs":[]},{"title":"(1)   Arguments of the parties","paragraphs":[]},{"title":"63","paragraphs":["para_227"]},{"title":"64","paragraphs":["para_229"]},{"title":"65","paragraphs":["para_231"]},{"title":"66","paragraphs":["para_233"]},{"title":"67","paragraphs":["para_235"]},{"title":"(2)   Findings of the Court","paragraphs":[]},{"title":"68","paragraphs":["para_238"]},{"title":"69","paragraphs":["para_240"]},{"title":"70","paragraphs":["para_242"]},{"title":"71","paragraphs":["para_244"]},{"title":"72","paragraphs":["para_246"]},{"title":"73","paragraphs":["para_248"]},{"title":"74","paragraphs":["para_250"]},{"title":"75","paragraphs":["para_252"]},{"title":"76","paragraphs":["para_254"]},{"title":"77","paragraphs":["para_256"]},{"title":"78","paragraphs":["para_258"]},{"title":"79","paragraphs":["para_260"]},{"title":"80","paragraphs":["para_262"]},{"title":"81","paragraphs":["para_264"]},{"title":"82","paragraphs":["para_266"]},{"title":"83","paragraphs":["para_268"]},{"title":"84","paragraphs":["para_270"]},{"title":"85","paragraphs":["para_272"]},{"title":"86","paragraphs":["para_274"]},{"title":"87","paragraphs":["para_276"]},{"title":"88","paragraphs":["para_278"]},{"title":"89","paragraphs":["para_280"]},{"title":"90","paragraphs":["para_282"]},{"title":"(b)\n  \n The second complaint in the second part of the first ground of appeal","paragraphs":[]},{"title":"(1)   Arguments of the parties","paragraphs":[]},{"title":"91","paragraphs":["para_286"]},{"title":"92","paragraphs":["para_288"]},{"title":"93","paragraphs":["para_290"]},{"title":"94","paragraphs":["para_292"]},{"title":"95","paragraphs":["para_294"]},{"title":"96","paragraphs":["para_296"]},{"title":"97","paragraphs":["para_298"]},{"title":"(2)   Findings of the Court","paragraphs":[]},{"title":"98","paragraphs":["para_301"]},{"title":"99","paragraphs":["para_303"]},{"title":"100","paragraphs":["para_305"]},{"title":"101","paragraphs":["para_307"]},{"title":"102","paragraphs":["para_309"]},{"title":"103","paragraphs":["para_311"]},{"title":"104","paragraphs":["para_313"]},{"title":"105","paragraphs":["para_315"]},{"title":"106","paragraphs":["para_317"]},{"title":"107","paragraphs":["para_319"]},{"title":"108","paragraphs":["para_321"]},{"title":"109","paragraphs":["para_323"]},{"title":"110","paragraphs":["para_325"]},{"title":"111","paragraphs":["para_327"]},{"title":"112","paragraphs":["para_329"]},{"title":"113","paragraphs":["para_331"]},{"title":"114","paragraphs":["para_333"]},{"title":"115","paragraphs":["para_335"]},{"title":"116","paragraphs":["para_337"]},{"title":"B.   The second ground of appeal","paragraphs":[]},{"title":"117","paragraphs":["para_340"]},{"title":"118","paragraphs":["para_342"]},{"title":"VI.   The action before the General Court","paragraphs":[]},{"title":"119","paragraphs":["para_345"]},{"title":"120","paragraphs":["para_347"]},{"title":"121","paragraphs":["para_349"]},{"title":"122","paragraphs":["para_351"]},{"title":"VII.   Costs","paragraphs":[]},{"title":"123","paragraphs":["para_354"]},{"title":"On those grounds, the Court (First Chamber) hereby:","paragraphs":["para_356","para_357","para_358"]},{"title":"Refers Case T‑557/20 back to the General Court of the European Union;","paragraphs":["para_360","para_361"]},{"title":"Biltgen","paragraphs":["para_363"]},{"title":"Kumin","paragraphs":[]},{"title":"Ziemele","paragraphs":[]},{"title":"Gervasoni","paragraphs":["para_367"]},{"title":"A. Calot Escobar","paragraphs":[]},{"title":"Registrar","paragraphs":[]},{"title":"F. Biltgen","paragraphs":[]},{"title":"President of the Chamber","paragraphs":["para_372"]}],"paragraphs":[{"text":"62023CJ0413","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (First Chamber)","paragraph_id":"para_2"},{"text":"4 September 2025 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Appeal – Protection of natural persons with regard to the processing of personal data – Procedure for granting compensation to shareholders and creditors of a banking institution following the resolution of that institution – Decision of the European Data Protection Supervisor finding that the Sing …","paragraph_id":"para_4"},{"text":"In Case C‑413/23 P,","paragraph_id":"para_5"},{"text":"APPEAL under Article 56 of the Statute of the Court of Justice of the European Union, brought on 5 July 2023,","paragraph_id":"para_6"},{"text":"European Data Protection Supervisor (EDPS) , represented initially by P. Candellier, G. Devin, X. Lareo, D. Nardi and T. Zerdick, and subsequently by P. Candellier, X. Lareo, D. Nardi, N. Stolić and T. Zerdick, acting as Agents,","paragraph_id":"para_7"},{"text":"appellant,","paragraph_id":"para_8"},{"text":"supported by:","paragraph_id":"para_9"},{"text":"European Data Protection Board , represented by C. Foglia, M. Gufflet, G. Le Grand and I. Vereecken, acting as Agents, and by E. de Lophem, avocat, G. Ryelandt, advocaat, and P. Vernet, avocat,","paragraph_id":"para_10"},{"text":"intervener in the appeal,","paragraph_id":"para_11"},{"text":"the other party to the proceedings being:","paragraph_id":"para_12"},{"text":"Single Resolution Board (SRB) , represented by H. Ehlers, M. Fernández Rupérez and A. Lapresta Bienz, acting as Agents, and by M. Braun, H.-G. Kamann, Rechtsanwälte, and F. Louis, avocat,","paragraph_id":"para_13"},{"text":"applicant at first instance,","paragraph_id":"para_14"},{"text":"supported by:","paragraph_id":"para_15"},{"text":"European Commission , represented by A. Bouchagiar and H. Kranenborg, acting as Agents,","paragraph_id":"para_16"},{"text":"intervener in the appeal,","paragraph_id":"para_17"},{"text":"THE COURT (First Chamber),","paragraph_id":"para_18"},{"text":"composed of F. Biltgen, President of the Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, acting as Judge of the First Chamber, A. Kumin, I. Ziemele and S. Gervasoni, Judges,","paragraph_id":"para_19"},{"text":"Advocate General: D. Spielmann,","paragraph_id":"para_20"},{"text":"Registrar: M. Longar, Administrator,","paragraph_id":"para_21"},{"text":"having regard to the written procedure and further to the hearing on 7 November 2024,","paragraph_id":"para_22"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 6 February 2025,","paragraph_id":"para_23"},{"text":"gives the following","paragraph_id":"para_24"},{"text":"Judgment","paragraph_id":"para_25"},{"text":"1","paragraph_id":"para_26"},{"text":"By his appeal, the European Data Protection Supervisor (EDPS) asks the Court of Justice to set aside the judgment of the General Court of the European Union of 26 April 2023, SRB v EDPS ( T‑557/20 , EU:T:2023:219 ; ‘the judgment under appeal’), by which the General Court annulled the revised decisio …","paragraph_id":"para_27"},{"text":"I.   Legal context","paragraph_id":"para_28"},{"text":"2","paragraph_id":"para_29"},{"text":"Recitals 5, 16, 17 and 35 of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC ( OJ 2018 L 295, p. 39 ) are worded as follows:","paragraph_id":"para_30"},{"text":"‘(5)","paragraph_id":"para_31"},{"text":"It is in the interest of a coherent approach to personal data protection throughout the [European] Union, and of the free movement of personal data within the Union, to align as far as possible the data protection rules for Union institutions, bodies, offices and agencies with the data protection ru …","paragraph_id":"para_32"},{"text":"…","paragraph_id":"para_33"},{"text":"(16)","paragraph_id":"para_34"},{"text":"The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information o …","paragraph_id":"para_35"},{"text":"(17)","paragraph_id":"para_36"},{"text":"The application of pseudonymisation to personal data can reduce the risks to the data subjects concerned and help controllers and processors to meet their data protection obligations. The explicit introduction of “pseudonymisation” in this Regulation is not intended to preclude any other measures of data protection.","paragraph_id":"para_37"},{"text":"…","paragraph_id":"para_38"},{"text":"(35)","paragraph_id":"para_39"},{"text":"The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into accou …","paragraph_id":"para_40"},{"text":"3","paragraph_id":"para_41"},{"text":"Article 3(1), (6), (8) and (13) of Regulation 2018/1725, headed ‘Definitions’, provides:","paragraph_id":"para_42"},{"text":"‘For the purposes of this Regulation, the following definitions apply:","paragraph_id":"para_43"},{"text":"(1)","paragraph_id":"para_44"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_45"},{"text":"…","paragraph_id":"para_46"},{"text":"(6)","paragraph_id":"para_47"},{"text":"“pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;","paragraph_id":"para_48"},{"text":"…","paragraph_id":"para_49"},{"text":"(8)","paragraph_id":"para_50"},{"text":"“controller” means the Union institution or body or the directorate-general or any other organisational entity which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by a specific Union act, the controller or the specific criteria for its nomination can be provided for by Union law;","paragraph_id":"para_51"},{"text":"…","paragraph_id":"para_52"},{"text":"(13)","paragraph_id":"para_53"},{"text":"“recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State …","paragraph_id":"para_54"},{"text":"4","paragraph_id":"para_55"},{"text":"Article 4 of that regulation, headed ‘Principles relating to processing of personal data’, provides, in paragraph 2:","paragraph_id":"para_56"},{"text":"‘The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_57"},{"text":"5","paragraph_id":"para_58"},{"text":"Article 14 of that regulation, headed ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, states, in paragraph 1:","paragraph_id":"para_59"},{"text":"‘The controller shall take appropriate measures to provide any information referred to in Articles 15 and 16 and any communication under Articles 17 to 24 and 35 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain langu …","paragraph_id":"para_60"},{"text":"6","paragraph_id":"para_61"},{"text":"Article 15 of that regulation, headed ‘Information to be provided where personal data are collected from the data subject’, provides as follows:","paragraph_id":"para_62"},{"text":"‘(1)   Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:","paragraph_id":"para_63"},{"text":"…","paragraph_id":"para_64"},{"text":"(d)","paragraph_id":"para_65"},{"text":"the recipients or categories of recipients of the personal data, if any;","paragraph_id":"para_66"},{"text":"…","paragraph_id":"para_67"},{"text":"(2)   In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:","paragraph_id":"para_68"},{"text":"(a)","paragraph_id":"para_69"},{"text":"the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;","paragraph_id":"para_70"},{"text":"(b)","paragraph_id":"para_71"},{"text":"the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or, where applicable, the right to object to processing or the right to data portability;","paragraph_id":"para_72"},{"text":"…","paragraph_id":"para_73"},{"text":"(e)","paragraph_id":"para_74"},{"text":"whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;","paragraph_id":"para_75"},{"text":"…’","paragraph_id":"para_76"},{"text":"7","paragraph_id":"para_77"},{"text":"Article 24 of Regulation 2018/1725 sets out the circumstances in which an individual decision may be based on automated processing, including profiling.","paragraph_id":"para_78"},{"text":"8","paragraph_id":"para_79"},{"text":"Article 26 of that regulation, headed ‘Responsibility of the controller’, provides, in paragraph 1 thereof:","paragraph_id":"para_80"},{"text":"‘Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.’","paragraph_id":"para_81"},{"text":"II.   Background to the dispute","paragraph_id":"para_82"},{"text":"9","paragraph_id":"para_83"},{"text":"The background to the dispute is set out in paragraphs 2 to 32 of the judgment under appeal and can be summarised as set out below.","paragraph_id":"para_84"},{"text":"10","paragraph_id":"para_85"},{"text":"On 7 June 2017, the SRB, in its executive session, adopted Decision SRB/EES/2017/08 concerning a resolution scheme in respect of Banco Popular Español, S.A. on the basis of Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a unif …","paragraph_id":"para_86"},{"text":"11","paragraph_id":"para_87"},{"text":"In that decision, the SRB, considering that the conditions laid down by Article 18(1) of the SRM Regulation were satisfied, decided to place Banco Popular Español SA (‘Banco Popular’) under resolution. Accordingly, the SRB decided to write down and convert Banco Popular’s capital instruments pursuant to Article 21 of that regulation and to apply the sale of business tool under Article 24 of that regulation by transferring the shares to a purchaser.","paragraph_id":"para_88"},{"text":"12","paragraph_id":"para_89"},{"text":"On the same day, the European Commission adopted Decision (EU) 2017/1246 endorsing the resolution scheme for Banco Popular Español S.A. ( OJ 2017 L 178, p. 15 ).","paragraph_id":"para_90"},{"text":"13","paragraph_id":"para_91"},{"text":"Following the resolution of Banco Popular, the SRB asked the auditing and advisory company Deloitte to undertake a valuation of difference in treatment, provided for in Article 20(16) to (18) of the SRM Regulation, carried out in order to determine whether the shareholders and creditors of Banco Popular would have received better treatment if the bank had entered into normal insolvency proceedings (‘Valuation 3’). On 14 June 2018, Deloitte sent that valuation to the SRB.","paragraph_id":"para_92"},{"text":"14","paragraph_id":"para_93"},{"text":"On 6 August 2018, the SRB published on its website its Notice of 2 August 2018 regarding its preliminary decision on whether compensation needs to be granted to the shareholders and creditors in respect of which the resolution actions concerning Banco Popular Español, S.A. have been effected and the …","paragraph_id":"para_94"},{"text":"15","paragraph_id":"para_95"},{"text":"In the preliminary decision, the SRB stated that, in order for it to be able to take its final decision on whether the shareholders and creditors affected by the resolution of Banco Popular (‘the affected shareholders and creditors’) should be granted compensation in accordance with Article 76(1)(e) …","paragraph_id":"para_96"},{"text":"A.   The right to be heard process","paragraph_id":"para_97"},{"text":"16","paragraph_id":"para_98"},{"text":"According to the information in the preliminary decision, the right to be heard process had to take place in two phases.","paragraph_id":"para_99"},{"text":"17","paragraph_id":"para_100"},{"text":"In the first phase (‘the registration phase’), the affected shareholders and creditors were invited to express their interest in exercising their right to be heard, using an online registration form which had to be completed by 14 September 2018. In that phase, the affected shareholders and creditor …","paragraph_id":"para_101"},{"text":"18","paragraph_id":"para_102"},{"text":"On 6 August 2018, the first day of the registration phase, the SRB also published, on the web page for registering for the right to be heard process and on its website, a privacy statement concerning the processing of personal data in the context of that process (‘the privacy statement’).","paragraph_id":"para_103"},{"text":"19","paragraph_id":"para_104"},{"text":"In the second phase (‘the consultation phase’), the persons whose status as affected shareholders and creditors had been verified by the SRB were able to submit their comments on the preliminary decision, to which Valuation 3 was annexed. On 16 October 2018, the SRB announced on its website that from 6 November 2018 the affected shareholders and creditors would be invited to submit their written comments on the preliminary decision during the consultation phase.","paragraph_id":"para_105"},{"text":"20","paragraph_id":"para_106"},{"text":"On 6 November 2018, the SRB sent an email to the affected shareholders and creditors containing a unique personal link to an online form, which comprised seven questions, with limited space for answering, enabling the affected shareholders and creditors to submit comments on the preliminary decision and on the non-confidential version of Valuation 3 by 26 November 2018.","paragraph_id":"para_107"},{"text":"21","paragraph_id":"para_108"},{"text":"The SRB examined the relevant comments from affected shareholders and creditors with regard to the preliminary decision. It asked Deloitte, in its capacity as independent valuer, to assess the relevant comments relating to Valuation 3, to provide it with a document containing its assessment, and to examine whether that valuation was still valid in the light of those comments.","paragraph_id":"para_109"},{"text":"B.   The processing of data collected by the SRB in the context of the right to be heard process","paragraph_id":"para_110"},{"text":"22","paragraph_id":"para_111"},{"text":"The data collected during the registration phase, that is to say, proof of the identity of the affected shareholders and creditors and proof of ownership of written down or converted and transferred capital instruments of Banco Popular, were accessible to a limited number of SRB staff, namely those tasked with processing those data in order to determine whether the affected shareholders and creditors were eligible for compensation.","paragraph_id":"para_112"},{"text":"23","paragraph_id":"para_113"},{"text":"The members of SRB staff responsible for the processing of the comments received during the consultation phase had access neither to the data collected in the registration phase – with the result that the comments were separated from the personal information of the affected shareholders and creditor …","paragraph_id":"para_114"},{"text":"24","paragraph_id":"para_115"},{"text":"As a first step, the SRB automatically filtered 23822 comments, each of which was allocated a unique alphanumeric code, submitted by 2855 participants in the process. Two algorithms identified 20101 comments as being identical. In the present instance, the comment submitted first was considered the original comment and was assessed in the analysis phase, and the identical comments received subsequently were identified as duplicates.","paragraph_id":"para_116"},{"text":"25","paragraph_id":"para_117"},{"text":"As a second step, the SRB identified the comments submitted which came within the scope of the right to be heard procedure in so far as they could have an influence on the preliminary decision or Valuation 3. Next, it divided those comments into those to be examined by the SRB because they related t …","paragraph_id":"para_118"},{"text":"26","paragraph_id":"para_119"},{"text":"As a third step, the comments relating to the preliminary decision were handled by the SRB while those relating to Valuation 3, that is to say, 1104 comments, were transferred to Deloitte on 17 June 2019, using a secure SRB-dedicated virtual data server. The SRB uploaded the files to be shared with …","paragraph_id":"para_120"},{"text":"27","paragraph_id":"para_121"},{"text":"The comments transferred to Deloitte were filtered, categorised and aggregated. Where the comments were duplicates of earlier comments, only one version was transmitted to Deloitte. This meant that individual comments that had been duplicated could not be distinguished within a single theme, and Deloitte was unaware whether a comment had been made by one or more participants in the right to be heard process.","paragraph_id":"para_122"},{"text":"28","paragraph_id":"para_123"},{"text":"The comments transferred to Deloitte were solely those that were received during the consultation phase and that bore an alphanumeric code. However, it was only the SRB who was able, via that code, to link the comments to the data, in particular to the identification data of the authors of the comme …","paragraph_id":"para_124"},{"text":"C.   The procedure before the EDPS","paragraph_id":"para_125"},{"text":"29","paragraph_id":"para_126"},{"text":"In October and December 2019, the affected shareholders and creditors who had responded to the form submitted five complaints to the EDPS under Regulation 2018/1725. In those complaints, they alleged an infringement of Article 15(1)(d) of that regulation, on the ground that the SRB had failed to inf …","paragraph_id":"para_127"},{"text":"30","paragraph_id":"para_128"},{"text":"Following a procedure in which the SRB provided various explanations at the request of the EDPS and the complainants submitted observations, the EDPS adopted, on 24 June 2020, a decision concerning five complaints submitted by several complainants against the Single Resolution Board (Cases 2019-947, …","paragraph_id":"para_129"},{"text":"31","paragraph_id":"para_130"},{"text":"On 22 July 2020, the SRB asked the EDPS to review the original decision under Article 18(1) of the Decision of the European Data Protection Supervisor of 15 May 2020 adopting the Rules of Procedure of the EDPS ( OJ 2020 L 204, p. 49 ). The SRB provided, inter alia, a detailed description of the righ …","paragraph_id":"para_131"},{"text":"32","paragraph_id":"para_132"},{"text":"On 5 August 2020, the EDPS informed the SRB that, in the light of new information provided, he had decided to re-examine the original decision and would adopt a decision replacing it.","paragraph_id":"para_133"},{"text":"33","paragraph_id":"para_134"},{"text":"On 24 November 2020, following the review procedure, during which the complainants submitted observations and the SRB provided additional information at the request of the EDPS, the latter adopted the decision at issue.","paragraph_id":"para_135"},{"text":"34","paragraph_id":"para_136"},{"text":"By that decision, the EDPS revised the initial decision in the following terms:","paragraph_id":"para_137"},{"text":"‘1.","paragraph_id":"para_138"},{"text":"The EDPS finds that the data the SRB shared with Deloitte were pseudonymous data, both because the comments in [the consultation phase] were personal data and because the SRB shared the alphanumeric code that allows linking the replies given in [the registration phase] with the ones given in [the consultation phase] – notwithstanding the fact that the data provided by the participants to identify themselves in [the registration phase] were not disclosed to Deloitte.","paragraph_id":"para_139"},{"text":"2.","paragraph_id":"para_140"},{"text":"The EDPS finds that Deloitte was a recipient of the complainants’ personal data under Article 3(13) of [Regulation 2018/1725]. The fact that Deloitte was not mentioned in SRB’s [privacy statement] as a potential recipient of the personal data collected and processed by the SRB as the controller in the context of the [right to be heard] process constitutes an infringement of the information obligations laid down in Article 15(1)(d) [of Regulation 2018/1725].","paragraph_id":"para_141"},{"text":"3.","paragraph_id":"para_142"},{"text":"In light of all the technical and organisational measures set up by the SRB to mitigate the risks for the individuals’ right to data protection in the context of the [right to be heard] process, the EDPS decides not to exercise any of his corrective powers laid down in Article 58(2) of [Regulation 2018/1725].","paragraph_id":"para_143"},{"text":"4.","paragraph_id":"para_144"},{"text":"The EDPS nevertheless recommends the SRB to ensure that the data protection notice in future [right to be heard] processes covers the processing of personal data in both the registration phase and the consultation phase, and includes all potential recipients of the information collected, in order to fully comply with the obligation to inform data subjects in accordance with Article 15 [of Regulation 2018/1725].’","paragraph_id":"para_145"},{"text":"III.   The procedure before the General Court and the judgment under appeal","paragraph_id":"para_146"},{"text":"35","paragraph_id":"para_147"},{"text":"By application lodged at the Registry of the General Court on 1 September 2020, the SRB brought an action seeking, first, annulment of the decision at issue and, second, a declaration that the initial decision was illegal.","paragraph_id":"para_148"},{"text":"36","paragraph_id":"para_149"},{"text":"In support of the first head of claim, the SRB raised two pleas in law, the first of which alleged infringement of Article 3(1) of Regulation 2018/1725 in so far as the information transmitted to Deloitte did not constitute personal data, and the second alleging infringement of the right to good administration, enshrined in Article 41 of the Charter.","paragraph_id":"para_150"},{"text":"37","paragraph_id":"para_151"},{"text":"By the judgment under appeal, the General Court rejected, on the ground of lack of jurisdiction, the second head of claim seeking a declaration that the initial decision was illegal, in so far as the SRB sought a declaratory judgment and not the annulment of an act.","paragraph_id":"para_152"},{"text":"38","paragraph_id":"para_153"},{"text":"However, the General Court declared the first head of claim admissible. Turning to the substance, it upheld the first plea of the action and annulled the decision at issue without examining the second plea in law.","paragraph_id":"para_154"},{"text":"IV.   Procedure before the Court and forms of order sought","paragraph_id":"para_155"},{"text":"39","paragraph_id":"para_156"},{"text":"By decision of the President of the Court of 20 October 2023, the European Commission was granted leave to intervene in support of the SRB. By order of the President of the Court of 29 November 2023, the European Data Protection Board was granted leave to intervene in support of the form of order sought by the EDPS.","paragraph_id":"para_157"},{"text":"40","paragraph_id":"para_158"},{"text":"The EDPS, supported by the European Data Protection Board, asks the Court to:","paragraph_id":"para_159"},{"text":"–","paragraph_id":"para_160"},{"text":"set aside the judgment under appeal;","paragraph_id":"para_161"},{"text":"–","paragraph_id":"para_162"},{"text":"deliver final judgment on the dispute;","paragraph_id":"para_163"},{"text":"–","paragraph_id":"para_164"},{"text":"order the SRB to pay the costs of the appeal proceedings and of the proceedings before the General Court.","paragraph_id":"para_165"},{"text":"41","paragraph_id":"para_166"},{"text":"The SRB, supported by the Commission, contends that the Court should:","paragraph_id":"para_167"},{"text":"–","paragraph_id":"para_168"},{"text":"dismiss the appeal;","paragraph_id":"para_169"},{"text":"–","paragraph_id":"para_170"},{"text":"in the alternative, annul the decision at issue;","paragraph_id":"para_171"},{"text":"–","paragraph_id":"para_172"},{"text":"in the further alternative, refer the case back to the General Court; and","paragraph_id":"para_173"},{"text":"–","paragraph_id":"para_174"},{"text":"order the EDPS to pay the costs of the appeal proceedings and of the proceedings before the General Court.","paragraph_id":"para_175"},{"text":"V.   The appeal","paragraph_id":"para_176"},{"text":"42","paragraph_id":"para_177"},{"text":"In support of his appeal, the EDPS, supported by the European Data Protection Board, raises two grounds of appeal, the first alleging infringement of Article 3(1) and (6) of Regulation 2018/1725, as interpreted by the Court of Justice, and the second alleging infringement of Article 4(2) and Article 26(1) of that regulation.","paragraph_id":"para_178"},{"text":"A.   The first ground of appeal","paragraph_id":"para_179"},{"text":"43","paragraph_id":"para_180"},{"text":"By his first ground of appeal, the EDPS submits, in essence, that, by holding that he had incorrectly concluded, in the decision at issue, that the information at issue in the present case constituted personal data, the General Court erred in law in its interpretation of Article 3(1) and (6) of Regu …","paragraph_id":"para_181"},{"text":"1.\n  \n The first part of the first ground of appeal, alleging misinterpretation of the condition, laid down in Article 3(1) of Regulation 2018/1725, that the information must ‘relate’ to a natural person","paragraph_id":"para_182"},{"text":"(a)\n  \n Arguments of the parties","paragraph_id":"para_183"},{"text":"44","paragraph_id":"para_184"},{"text":"By the first part of the first ground of appeal, the EDPS submits that, contrary to what the General Court held, in paragraphs 60 to 74 of the judgment under appeal, the information transmitted to Deloitte did relate to a natural person within the meaning of Article 3(1) of Regulation 2018/1725.","paragraph_id":"para_185"},{"text":"45","paragraph_id":"para_186"},{"text":"In the first place, the EDPS submits that, contrary to what follows from paragraph 70 of the judgment under appeal, data protection authorities cannot be required to carry out, in all cases, an examination of the content, purpose or effect of information in order to ascertain whether it relates to a …","paragraph_id":"para_187"},{"text":"46","paragraph_id":"para_188"},{"text":"In the second place, contrary to the finding in paragraph 71 of the judgment under appeal, the EDPS maintains that, in order to conclude that the data in question were personal data, he relied not only on the nature of the comments transmitted to Deloitte, but also on the fact that the alphanumeric code had also been transmitted to that company.","paragraph_id":"para_189"},{"text":"47","paragraph_id":"para_190"},{"text":"In the third place, the EDPS claims that the judgment under appeal is marred by a contradiction in so far as the General Court, on the one hand, found in paragraph 7 of that judgment that the very purpose of the comments transmitted to Deloitte was to allow specific natural persons, namely the affec …","paragraph_id":"para_191"},{"text":"48","paragraph_id":"para_192"},{"text":"The SRB, supported by the Commission, contends that that line of argument must be rejected.","paragraph_id":"para_193"},{"text":"49","paragraph_id":"para_194"},{"text":"In the first place, according to the case-law arising from the judgments of 20 December 2017, Nowak ( C‑434/16 , EU:C:2017:994 , paragraphs  34 and  35 ), and of 4 May 2023, Österreichische Datenschutzbehörde and CRIF ( C‑487/21 , EU:C:2023:369 , paragraphs  23 and  24 ), objective or subjective inf …","paragraph_id":"para_195"},{"text":"50","paragraph_id":"para_196"},{"text":"In the second place, the EDPS’s claim that the nature of those comments as personal data necessarily follows from their purpose constitutes a new factual claim, made for the first time before the appeal court, which is therefore inadmissible. In any event, that claim is ineffective since the EDPS did not examine that point in the decision at issue.","paragraph_id":"para_197"},{"text":"51","paragraph_id":"para_198"},{"text":"As regards, in the third place, the alleged contradiction in the grounds in paragraphs 7 and 73 of the judgment under appeal, the SRB submits that the description in paragraph 7 of that judgment does not contain any information on the content, purpose or effect of the comments transmitted to Deloitte and, therefore, does not contradict the conclusion set out in paragraph 73 of that judgment.","paragraph_id":"para_199"},{"text":"(b)\n  \n Findings of the Court","paragraph_id":"para_200"},{"text":"52","paragraph_id":"para_201"},{"text":"As a preliminary point, it should be noted that the definition of the concept of ‘personal data’ set out in Article 3(1) of Regulation 2018/1725 is essentially identical to that in Article 4(1) of the GDPR, which itself has a scope that is essentially identical to that set out in Article 2(a) of Dir …","paragraph_id":"para_202"},{"text":"53","paragraph_id":"para_203"},{"text":"Article 3(1) of Regulation 2018/1725 provides that ‘personal data’ is to mean ‘any information relating to an identified or identifiable natural person’.","paragraph_id":"para_204"},{"text":"54","paragraph_id":"para_205"},{"text":"The Court has held that the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in that provision and in Article 4(1) of the GDPR reflects the aim of the EU legislature to assign a wide scope to that concept, which potentially encompasses all kinds of informat …","paragraph_id":"para_206"},{"text":"55","paragraph_id":"para_207"},{"text":"Information relates to an identified or identifiable natural person where, by reason of its content, purpose or effect, it is linked to an identifiable person (judgments of 20 December 2017, Nowak, C‑434/16 , EU:C:2017:994 , paragraph  35 ; of 7 March 2024, OC v Commission, C‑479/22 P , EU:C:2024:215 , paragraph  45 ; and of 7 March 2024, IAB Europe, C‑604/22 , EU:C:2024:214 , paragraph  37 and the case-law cited).","paragraph_id":"para_208"},{"text":"56","paragraph_id":"para_209"},{"text":"In the present case, despite the General Court noting, in paragraph 70 of the judgment under appeal, that the EDPS had not examined the content, purpose or effect of the information contained in the comments transmitted to Deloitte, it is nevertheless apparent from paragraphs 71 and 72 of that judgm …","paragraph_id":"para_210"},{"text":"57","paragraph_id":"para_211"},{"text":"However, in paragraphs 73 and 74 of the judgment under appeal, the General Court held that the EDPS could not classify the information contained in the comments transmitted to Deloitte as personal data solely on the basis of the finding that they were personal opinions or views, but that he should also have examined the content, purpose and effect of the opinions expressed therein, in order to determine whether they were linked to a particular person.","paragraph_id":"para_212"},{"text":"58","paragraph_id":"para_213"},{"text":"That assessment by the General Court misconstrues the particular nature of personal opinions or views which, as an expression of a person’s thinking, are necessarily closely linked to that person.","paragraph_id":"para_214"},{"text":"59","paragraph_id":"para_215"},{"text":"The interpretation adopted in the preceding paragraph is supported by the case-law arising from the judgment of 20 December 2017, Nowak ( C‑434/16 , EU:C:2017:994 ), which concerned, inter alia, an examiner’s comments on the written answers of a candidate at a professional examination. In paragraphs …","paragraph_id":"para_216"},{"text":"60","paragraph_id":"para_217"},{"text":"It follows that the General Court erred in law in holding, in paragraphs 73 and 74 of the judgment under appeal, that the EDPS, in order to conclude that the information contained in the comments transmitted to Deloitte ‘related’, within the meaning of Article 3(1) of Regulation 2018/1725, to the pe …","paragraph_id":"para_218"},{"text":"61","paragraph_id":"para_219"},{"text":"Accordingly, without it being necessary to examine the arguments summarised in paragraphs 46 and 47 of the present judgment, the first part of the first ground of appeal must be upheld.","paragraph_id":"para_220"},{"text":"2.\n  \n The second part of the first ground of appeal, alleging a misinterpretation of the condition, laid down in Article 3(1) of Regulation 2018/1725, that the information must relate to an ‘identifiable’ natural person","paragraph_id":"para_221"},{"text":"62","paragraph_id":"para_222"},{"text":"By the second part of the first ground of appeal, the EDPS submits that, in paragraphs 76 to 106 of the judgment under appeal, the General Court incorrectly held that he could not find that the information contained in the comments transmitted to Deloitte related to an ‘identifiable’ natural person, within the meaning of Article 3(1) of Regulation 2018/1725. That part consists of two separate complaints.","paragraph_id":"para_223"},{"text":"(a)\n  \n The first complaint in the second part of the first ground of appeal","paragraph_id":"para_224"},{"text":"(1)   Arguments of the parties","paragraph_id":"para_225"},{"text":"63","paragraph_id":"para_226"},{"text":"First of all, the EDPS recalls that, under Article 3(1) of Regulation 2018/1725, the controller or ‘another person’ must be able to identify a data subject concerned by the information in question. In the absence of any indication as to the person who must be able to carry out that identification, i …","paragraph_id":"para_227"},{"text":"64","paragraph_id":"para_228"},{"text":"According to the EDPS, the findings in paragraphs 90 and 91 of the judgment under appeal do not take sufficient account of the wording of those provisions and of the distinction between anonymisation and pseudonymisation. In that regard, the European Data Protection Board states that, according to t …","paragraph_id":"para_229"},{"text":"65","paragraph_id":"para_230"},{"text":"Next, the EDPS claims that, by introducing the concept of pseudonymisation, the EU legislature clarified that, in order to exclude personal data from the scope of EU law on the protection of such data, it is not sufficient to separate those data from the additional information enabling the data subject to be identified.","paragraph_id":"para_231"},{"text":"66","paragraph_id":"para_232"},{"text":"Lastly, the EDPS recalls that the concept of personal data must be interpreted broadly, which is, in his view, necessary in order for data protection law to have its practical effect. In so far as the General Court’s interpretation would allow pseudonymised data incorrectly to be regarded as anonymo …","paragraph_id":"para_233"},{"text":"67","paragraph_id":"para_234"},{"text":"The SRB, supported by the Commission, disputes that line of argument.","paragraph_id":"para_235"},{"text":"(2)   Findings of the Court","paragraph_id":"para_236"},{"text":"68","paragraph_id":"para_237"},{"text":"The first complaint of the second part of the first ground of appeal is, in essence, based on the consideration that pseudonymised data such as the comments transmitted to Deloitte constitute, in all cases, personal data solely because of the existence of information enabling the data subject to be identified, without it being necessary to examine specifically whether, despite pseudonymisation, the person to whom those data relate is identifiable.","paragraph_id":"para_238"},{"text":"69","paragraph_id":"para_239"},{"text":"In that regard, it must be borne in mind that, under Article 3(1) of Regulation 2018/1725, information must relate to an ‘identified or identifiable’ natural person in order to be classified as personal data within the meaning of that provision. Accordingly, the application of that regulation presupposes, in principle, an examination of whether the data subject is identified or identifiable by the information in question.","paragraph_id":"para_240"},{"text":"70","paragraph_id":"para_241"},{"text":"That interpretation is borne out by the fifth and sixth sentences of recital 16 of Regulation 2018/1725, according to which the definition of the concept of ‘personal data’ does not include ‘anonymous information, namely information which does not relate to an identified or identifiable natural pers …","paragraph_id":"para_242"},{"text":"71","paragraph_id":"para_243"},{"text":"As regards, specifically, pseudonymised data, the Court notes, in the first place, that those data are not mentioned in the legislative definition of the concept of ‘personal data’ in Article 3(1) of Regulation 2018/1725, but that their characteristics are apparent from Article 3(6) of that regulati …","paragraph_id":"para_244"},{"text":"72","paragraph_id":"para_245"},{"text":"As the Advocate General observed, in essence, in points 46 and 48 of his Opinion, pseudonymisation is therefore not part of the definition of ‘personal data’, but refers to the establishment of technical and organisational measures to reduce the risk of a data set being correlated with the identity …","paragraph_id":"para_246"},{"text":"73","paragraph_id":"para_247"},{"text":"In the second place, it is apparent from the wording of Article 3(6) of Regulation 2018/1725 that the concept of ‘pseudonymisation’ presupposes the existence of information enabling the data subject to be identified. The very existence of such information precludes data that have undergone pseudonymisation from being regarded, in all cases, as anonymous data, which is excluded from the scope of that regulation.","paragraph_id":"para_248"},{"text":"74","paragraph_id":"para_249"},{"text":"The fact remains that, in the third place, the requirement that the identifying information be kept separately and that it be subject to technical and organisational measures ‘to ensure that the personal data are not attributed to an identified or identifiable natural person’, laid down in Article 3 …","paragraph_id":"para_250"},{"text":"75","paragraph_id":"para_251"},{"text":"Accordingly, provided that such technical and organisational measures are actually put in place and are such as to prevent the data in question from being attributed to the data subject, in such a way that the data subject is not or is no longer identifiable, pseudonymisation may have an impact on whether or not those data are personal within the meaning of Article 3(1) of Regulation 2018/1725.","paragraph_id":"para_252"},{"text":"76","paragraph_id":"para_253"},{"text":"In that regard, the Court notes that, as is usually the case for controllers who have pseudonymised data, the SRB does, in the present case, have additional information enabling the comments transmitted to Deloitte to be attributed to the data subject, with the result that, in its view, those comments are, in spite of pseudonymisation, still personal in nature.","paragraph_id":"para_254"},{"text":"77","paragraph_id":"para_255"},{"text":"As regards Deloitte, to which the SRB transmitted pseudonymised comments, the technical and organisational measures referred to in Article 3(6) of Regulation 2018/1725 may, as the SRB essentially submits, have the effect that, for that company, those comments are not personal in nature. However, tha …","paragraph_id":"para_256"},{"text":"78","paragraph_id":"para_257"},{"text":"That interpretation is borne out by recital 16 of Regulation 2018/1725 which, after setting out, in its first sentence, that ‘the principles of data protection should apply to any information concerning an identified or identifiable natural person’, states, in its second sentence, that ‘personal dat …","paragraph_id":"para_258"},{"text":"79","paragraph_id":"para_259"},{"text":"Accordingly, following those statements relating to personal data and pseudonymised data, the third sentence of that recital specifies that, in order to determine whether a natural person is identifiable, account should be taken of ‘all the means reasonably likely’ to be used by the controller or by …","paragraph_id":"para_260"},{"text":"80","paragraph_id":"para_261"},{"text":"As the Advocate General observed, in essence, in point 51 of his Opinion, those clarifications relating to the assessment of whether or not the data subject is identifiable would be deprived of any practical effect if pseudonymised data were to be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of Regulation 2018/1725.","paragraph_id":"para_262"},{"text":"81","paragraph_id":"para_263"},{"text":"In that regard, the Court notes that, as regards a press release which contained a certain number of statements relating to a person without naming him or her, the Court of Justice did not confine itself, in its judgment of 7 March 2024, OC v Commission ( C‑479/22 P , EU:C:2024:215 , paragraphs  52 …","paragraph_id":"para_264"},{"text":"82","paragraph_id":"para_265"},{"text":"In addition, the Court has previously held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for exa …","paragraph_id":"para_266"},{"text":"83","paragraph_id":"para_267"},{"text":"In the same vein, the Court has, in essence, held, in particular in the judgments of 19 October 2016, Breyer ( C‑582/14 , EU:C:2016:779 , paragraphs  44 , 47 and  48 ), and of 7 March 2024, IAB Europe ( C‑604/22 , EU:C:2024:214 , paragraphs  43 and  48 ), that data that are inherently impersonal and …","paragraph_id":"para_268"},{"text":"84","paragraph_id":"para_269"},{"text":"Above all, according to the case-law arising from the judgment of 9 November 2023, Gesamtverband Autoteile-Handel (Access to vehicle information) ( C‑319/22 , EU:C:2023:837 , paragraphs  46 and  49 ), data which are in themselves impersonal may become ‘personal’ in nature where the controller puts t …","paragraph_id":"para_270"},{"text":"85","paragraph_id":"para_271"},{"text":"Consequently, in the light of the case-law referred to in the preceding paragraph, the EDPS is incorrect in so far as he submits that the fact that pseudonymised data are not, as the case may be, personal in nature for persons to whom the controller transfers the pseudonymised data makes it unduly p …","paragraph_id":"para_272"},{"text":"86","paragraph_id":"para_273"},{"text":"It follows that, contrary to what the EDPS maintains, pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of Regulation 2018/1725, in so far as pseudonymisation may, depending on the circumstances of the case, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable.","paragraph_id":"para_274"},{"text":"87","paragraph_id":"para_275"},{"text":"That interpretation is not called into question by the fact relied on by the EDPS that the fourth sentence of recital 16 of Regulation 2018/1725 refers to the controller or ‘another person’. It follows from the very wording of that sentence, recalled in paragraph 79 of the present judgment, that it …","paragraph_id":"para_276"},{"text":"88","paragraph_id":"para_277"},{"text":"As regards the EDPS’s argument based on the objective of ensuring a high level of protection of personal data, although the wording of Article 3(1) of Regulation 2018/1725 reflects the EU legislature’s objective of attributing a broad meaning to the concept of ‘personal data’, that concept is not unlimited since that provision requires, inter alia, that the data subject be identified or identifiable.","paragraph_id":"para_278"},{"text":"89","paragraph_id":"para_279"},{"text":"In particular, as the Advocate General observed in point 58 of his Opinion, Regulation 2018/1725 contains obligations, such as the obligation to provide information to the data subject laid down in Article 15 of that regulation, compliance with which requires the data subject to be identified. Such obligations cannot be imposed on an entity which is in no way in a position to carry out that identification.","paragraph_id":"para_280"},{"text":"90","paragraph_id":"para_281"},{"text":"Consequently, the first complaint in the second part of the first ground must be rejected as unfounded.","paragraph_id":"para_282"},{"text":"(b)\n  \n The second complaint in the second part of the first ground of appeal","paragraph_id":"para_283"},{"text":"(1)   Arguments of the parties","paragraph_id":"para_284"},{"text":"91","paragraph_id":"para_285"},{"text":"By the second complaint in the second part of the first ground of appeal, the EDPS submits that the General Court disregarded the case-law arising from the judgment of 19 October 2016, Breyer ( C‑582/14 , EU:C:2016:779 ).","paragraph_id":"para_286"},{"text":"92","paragraph_id":"para_287"},{"text":"In the first place, the General Court disregarded the objective nature of the condition relating to the ‘identifiable’ nature of the data subject, by holding, in paragraphs 97, 99 and 100 of the judgment under appeal, in particular, that the EDPS should have examined whether the comments transmitted …","paragraph_id":"para_288"},{"text":"93","paragraph_id":"para_289"},{"text":"In the second place, the EDPS submits that, in that judgment, whether or not the data subject was identifiable was assessed from the perspective of the controller, in the absence of any relationship between that controller and the entities holding the additional information enabling that person to b …","paragraph_id":"para_290"},{"text":"94","paragraph_id":"para_291"},{"text":"In any event, even if he were nevertheless required to assess whether Deloitte was in a position to identify the authors of the comments which had been transmitted to it, the EDPS maintains that there was nothing to prevent Deloitte from identifying them.","paragraph_id":"para_292"},{"text":"95","paragraph_id":"para_293"},{"text":"The SRB, supported by the Commission, disputes that line of argument.","paragraph_id":"para_294"},{"text":"96","paragraph_id":"para_295"},{"text":"In the first place, in paragraphs 96, 97 and 100 of the judgment under appeal, in particular, the General Court correctly relied on an approach according to which the identifiable nature of the data subject must be examined in relation to each person and each controller concerned who processes the r …","paragraph_id":"para_296"},{"text":"97","paragraph_id":"para_297"},{"text":"In the second place, the SRB submits that the line of argument based on the alleged differences between the present case and that which led to the judgment of 19 October 2016, Breyer ( C‑582/14 , EU:C:2016:779 ), is inadmissible. It claims that that line of argument calls into question the General C …","paragraph_id":"para_298"},{"text":"(2)   Findings of the Court","paragraph_id":"para_299"},{"text":"98","paragraph_id":"para_300"},{"text":"In paragraphs 97 to 100 of the judgment under appeal, in particular, the General Court held, in essence, that, in accordance with the case-law arising from the judgment of 19 October 2016, Breyer ( C‑582/14 , EU:C:2016:779 ), the EDPS should have examined whether the comments transmitted to Deloitte …","paragraph_id":"para_301"},{"text":"99","paragraph_id":"para_302"},{"text":"As a preliminary point, the Court notes that Article 3(1) of Regulation 2018/1725 does not expressly specify the relevant perspective for assessing the identifiable nature of the data subject, whereas recital 16 of that regulation refers, without distinction, to the ‘controller’ or ‘another person’. …","paragraph_id":"para_303"},{"text":"100","paragraph_id":"para_304"},{"text":"According to the case-law resulting, inter alia, from the judgment of 19 October 2016, Breyer ( C‑582/14 , EU:C:2016:779 ), recalled in paragraphs 81 to 84 of the present judgment, the relevant perspective for assessing whether the data subject is identifiable depends, in essence, on the circumstances of the processing of the data in each individual case.","paragraph_id":"para_305"},{"text":"101","paragraph_id":"para_306"},{"text":"In the present case, the Court recalls that, in the decision at issue, the EDPS found that, by failing to mention Deloitte as a potential recipient of the comments in the privacy statement set out at the time when they were collected, the SRB had failed to fulfil its obligation to provide information under Article 15(1)(d) of Regulation 2018/1725.","paragraph_id":"para_307"},{"text":"102","paragraph_id":"para_308"},{"text":"Article 15(1) of that regulation determines the information which the controller must provide to the data subject, where personal data are collected from the data subject, while specifying that that information must be provided to the data subject ‘at the time when personal data are obtained’. It fo …","paragraph_id":"para_309"},{"text":"103","paragraph_id":"para_310"},{"text":"As regards, specifically, the information relating to the potential recipients of the personal data, referred to in Article 15(1)(d) of that regulation, that is information to be provided, among others, when the data are collected from the data subject.","paragraph_id":"para_311"},{"text":"104","paragraph_id":"para_312"},{"text":"Article 14(1) of Regulation 2018/1725 provides that the controller is to take appropriate measures to ensure, in particular, that the information referred to, inter alia, in Article 15 of that regulation is provided to the data subject in a concise, transparent, comprehensible, and easily accessible …","paragraph_id":"para_313"},{"text":"105","paragraph_id":"para_314"},{"text":"The importance of compliance with such an information obligation is confirmed by recital 35 of Regulation 2018/1725, the first and second sentences of which state that the principles of fair and transparent processing require that the data subject be informed of the existence of the processing opera …","paragraph_id":"para_315"},{"text":"106","paragraph_id":"para_316"},{"text":"Thus, where the collection of such data from the data subject is – as, in the present case, in the context of the procedure relating to the right to be heard – based on that data subject’s consent, the validity of the consent given by that data subject depends, inter alia, on whether that data subje …","paragraph_id":"para_317"},{"text":"107","paragraph_id":"para_318"},{"text":"Moreover, as regards a situation in which there is an obligation incumbent on the data subject to provide personal data to the controller, recital 35 of that regulation specifies, in the fourth sentence, that the data subject should also be informed whether he or she is obliged to provide the person …","paragraph_id":"para_319"},{"text":"108","paragraph_id":"para_320"},{"text":"In those circumstances, it appears that one of the purposes of the obligation to provide the data subject – at the time of collection of the personal data linked to him or her – with information relating to the potential recipients of those data is to enable that data subject to decide, in full knowledge of the facts, whether to provide or, on the contrary, refuse to provide the personal data being collected from him or her.","paragraph_id":"para_321"},{"text":"109","paragraph_id":"para_322"},{"text":"The Court adds that, as the Commission maintained, in essence, at the hearing, the information relating to potential recipients is indeed also essential in order for the data subject to be able to defend his or her rights against those recipients subsequently. However, the obligation to provide that …","paragraph_id":"para_323"},{"text":"110","paragraph_id":"para_324"},{"text":"It follows that, as the Advocate General observed in point 69 of his Opinion, the obligation to provide information laid down in Article 15(1)(d) of Regulation 2018/1725 is part of the legal relationship between the data subject and the controller and, therefore, it concerns the information in relation to that data subject as it was transmitted to that controller, thus before any potential transfer to a third party.","paragraph_id":"para_325"},{"text":"111","paragraph_id":"para_326"},{"text":"Accordingly, it must be held that, for the purposes of applying the obligation to provide information laid down in Article 15(1)(d) of Regulation 2018/1725, the identifiable nature of the data subject must be assessed at the time of collection of the data and from the point of view of the controller.","paragraph_id":"para_327"},{"text":"112","paragraph_id":"para_328"},{"text":"It follows that, as the Advocate General observed, in essence, in point 79 of his Opinion, the SRB’s obligation to provide information was applicable in the present case prior to the transfer of the data at issue and irrespective of whether or not those data were personal data, from Deloitte’s point of view, after any potential pseudonymisation.","paragraph_id":"para_329"},{"text":"113","paragraph_id":"para_330"},{"text":"That interpretation is not called into question by the SRB’s argument based on the wording of Article 15(1)(d) of Regulation 2018/1725, which refers to the ‘recipients … of the personal data’. Accordingly, as is apparent from paragraphs 102 to 108 of the present judgment, that provision governs the …","paragraph_id":"para_331"},{"text":"114","paragraph_id":"para_332"},{"text":"As the Advocate General observed, in essence, in point 77 of his Opinion, the SRB’s line of argument that it is necessary to put oneself in the recipient’s position in order to review compliance with that obligation to provide information would have the effect of shifting the timing of that review. …","paragraph_id":"para_333"},{"text":"115","paragraph_id":"para_334"},{"text":"Accordingly, the General Court erred in law in holding, in paragraphs 97, 98, 100, 101 and 103 to 105 of the judgment under appeal, that, in order to assess whether the SRB had complied with its obligation to provide information under Article 15(1)(d) of Regulation 2018/1725, the EDPS should have examined whether the comments transmitted to Deloitte constituted, from Deloitte’s point of view, personal data.","paragraph_id":"para_335"},{"text":"116","paragraph_id":"para_336"},{"text":"It follows that, without there being any need to examine the EDPS’s arguments summarised in paragraphs 93 and 94 of the present judgment, the second complaint in the second part of the first ground of appeal must be upheld.","paragraph_id":"para_337"},{"text":"B.   The second ground of appeal","paragraph_id":"para_338"},{"text":"117","paragraph_id":"para_339"},{"text":"Since the first part and the second complaint of the second part of the first ground of appeal are well founded, there is no need to examine the EDPS’s second ground of appeal, alleging infringement of Article 4(2) and Article 26(1) of Regulation 2018/1725.","paragraph_id":"para_340"},{"text":"118","paragraph_id":"para_341"},{"text":"Since the first ground of appeal has thus been upheld, the judgment under appeal must be set aside.","paragraph_id":"para_342"},{"text":"VI.   The action before the General Court","paragraph_id":"para_343"},{"text":"119","paragraph_id":"para_344"},{"text":"In accordance with the second sentence of the first paragraph of Article 61 of the Statute of the Court of Justice of the European Union, if the decision of the General Court is set aside, the Court of Justice may itself give final judgment in a matter, where the state of the proceedings so permits.","paragraph_id":"para_345"},{"text":"120","paragraph_id":"para_346"},{"text":"In the present case, the state of the proceedings permits final judgment to be given as regards the first plea in law of the action, alleging infringement by the EDPS of Article 3(1) of Regulation 2018/1725, in so far as the information transmitted to Deloitte did not constitute personal data. In th …","paragraph_id":"para_347"},{"text":"121","paragraph_id":"para_348"},{"text":"By contrast, the state of the proceedings does not permit final judgment to be given on the second plea in law, since that plea involves factual assessments which were not made by the General Court.","paragraph_id":"para_349"},{"text":"122","paragraph_id":"para_350"},{"text":"Consequently, the case must be referred back to the General Court so that the second plea in law can be examined.","paragraph_id":"para_351"},{"text":"VII.   Costs","paragraph_id":"para_352"},{"text":"123","paragraph_id":"para_353"},{"text":"As the case is to be referred back to the General Court, it is appropriate to reserve the costs relating to the appeal.","paragraph_id":"para_354"},{"text":"On those grounds, the Court (First Chamber) hereby:","paragraph_id":"para_355"},{"text":"1.","paragraph_id":"para_356"},{"text":"Sets aside the judgment of the General Court of the European Union of 26 April 2023, SRB v EDPS ( T‑557/20 , EU:T:2023:219 );","paragraph_id":"para_357"},{"text":"2.","paragraph_id":"para_358"},{"text":"Refers Case T‑557/20 back to the General Court of the European Union;","paragraph_id":"para_359"},{"text":"3.","paragraph_id":"para_360"},{"text":"Reserves the costs.","paragraph_id":"para_361"},{"text":"Biltgen","paragraph_id":"para_362"},{"text":"von Danwitz","paragraph_id":"para_363"},{"text":"Kumin","paragraph_id":"para_364"},{"text":"Ziemele","paragraph_id":"para_365"},{"text":"Gervasoni","paragraph_id":"para_366"},{"text":"Delivered in open court in Luxembourg on 4 September 2025.","paragraph_id":"para_367"},{"text":"A. Calot Escobar","paragraph_id":"para_368"},{"text":"Registrar","paragraph_id":"para_369"},{"text":"F. Biltgen","paragraph_id":"para_370"},{"text":"President of the Chamber","paragraph_id":"para_371"},{"text":"(\n *1\n ) Language of the case: English.","paragraph_id":"para_372"}],"word_count":11483,"cites":["C-413/23","T-557/20","C-434/16","C-487/21","C-479/22","C-604/22","C-200/23","C-683/21","C-582/14","C-319/22","C-40/17","C-757/22"],"cited_by":[],"sha256":"b1feac2bb02a6fd658292659e00a303d88b597838584aa8ae6fbb601ccb704ce","source_url":"https://publications.europa.eu/resource/celex/62023CJ0413.ENG.xhtml.ECR_62023CJ0413_EN_01.html","fetched_at":"2026-10-01T18:14:33.771+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-413-23-p-62023cj0413","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-413-23-p-62023cj0413","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-413-23-p-62023cj0413","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-413-23-p-62023cj0413","verification":{"stored_sha256":"b1feac2bb02a6fd658292659e00a303d88b597838584aa8ae6fbb601ccb704ce","recomputed_sha256":"b1feac2bb02a6fd658292659e00a303d88b597838584aa8ae6fbb601ccb704ce","intact":true,"checked_at":"2026-10-27T14:01:45.235Z"},"verification_scope":{"stored_hash_is_source_verification":false,"official_source_comparison":"not_performed","legal_review":"not_assessed"}},"hash":"sha256:bef909adc6b43f582c4867c7bb5dbf3918c8acbd1820bad20b73b0f8c0641d80","version":"legal-2026-10-27","expires":"2026-10-28T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-27+legal-2026-10-27+2026-10-27T12:37:01","content_hash":"sha256:bef909adc6b43f582c4867c7bb5dbf3918c8acbd1820bad20b73b0f8c0641d80","revalidate_after":"2026-10-27T15:01:45.572Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-413-23-p-62023cj0413","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-413-23-p-62023cj0413"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-413-23-p-62023cj0413"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-413-23-p-62023cj0413"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-413-23-p-62023cj0413","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-a1227b32ffb8195323f0c46f68712391","response_hash":"sha256:bef909adc6b43f582c4867c7bb5dbf3918c8acbd1820bad20b73b0f8c0641d80"}},"freshness":{"freshness_class":"live","as_of":"2026-11-03T14:26:22.168Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-413-23-p-62023cj0413&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":24227}}