On 4 September 2025, the Court of Justice of the European Union delivered a pivotal judgment in Case C-413/23 EDPS v SRB, prompting the data protection community to take a fresh look at key concepts in EU data protection law. The Court clarified three crucial issues central to the interpretation of data protection law: that personal opinions are inherently personal data; that pseudonymised data do not necessarily qualify as personal data in all cases and for everyone; and that the controller’s transparency obligations remain even when sharing data that have undergone pseudonymisation.
Building on this court decision, the European Commission laid down a proposal on 19 November 2025 to change the very definition of personal data. This panel will unpack the implications of the judgment for data controllers, regulators and data protection professionals. The discussion will also explore whether the proposed new definition of personal data aligns with existing case law on the distinction between personal and non-personal data in the EU’s data protection landscape.
- If pseudonymous data are not always personal data for everyone, how can the controller assess in practice the likelihood that a recipient could identify a data subject?
- And what threshold of identifiability should be applied - does it require naming a person, or merely distinguishing them within a group?
- How should organisations adapt their transparency practices in light of this nuanced approach to personal data?
- Is the Court’s reasoning on the obligation to inform applicable also to broader compliance duties under the GDPR?
- And, finally, does the judgment really change everything to the point that it was necessary to touch upon the core premise of data protection: the concept of personal data?
Moderator: Thomas Zerdick, Acting Secretary-General of the European Data Protection Supervisor
Speakers:
- Prof. Anna Berlee, Open Universiteit, Amsterdam
- Maarten Daman, Data Protection Officer, European Central Bank
- Daniele Nardi, Legal Service Officer, European Data Protection Supervisor