Pseudonymisation scrutinised by the CJEU

This fundamental question has day-to-day practical implications to organisations processing personal data in a pseudonymised form and sharing it with third parties and will facilitate such data sharing activities. However, in reaching this conclusion, the Court has disregarded long-standing views of EU data protection regulators. 

You can read about the background of the decision and the issues addressed in more detail in our paper.

Download here - Insights: Pseudonymisation scrutinised by the CJEU

Key take-aways:

• The decision provides clarity: a pseudonymised dataset may be anonymous in the hands of a third party.
• The decision will provide flexibility when sharing data with third parties. However, the parties of a data sharing agreement, will still have to agree on whether the recipient has means to re-identify the data.
• The decision concerned a controller-to-controller transfer. However, it does not necessarily apply to the situation where the recipient is a processor or a joint controller. If it did not apply to instances where the recipient is a processor or a joint controller, the EU would mirror the UK position on this matter set out in the UK ICO's guidance.
• The organisation sharing a pseudonymised dataset considered anonymous in the hands of the recipient will still need to comply with GDPR requirements in relation to that dataset, in particular providing information to individuals about the fact that their data is going to be shared with a third-party recipient. This is explicitly set out in the decision.
• In practice, the organisation sharing the data should consider putting in place contractual terms to cover an eventual re-identification and restrict any reidentification efforts form by the recipient.

While this presents a step forward in clarifying the concept of personal data and facilitating data sharing, care will be needed in drafting appropriate terms especially if reliance is made on the assumption that the data set is anonymous (for the recipient).