The European General Court, a constituent court of the Court of Justice of the European Union, ruled on April 26, 2023 on a dispute between a European agency (Single Resolution Board – SRB) and the EDPS concerning the appeal of a decision of the European Supervisor against the same SRB for alleged violation of the information obligations of the data subjects, through the privacy notice.

The matter has important general implications related to the following questions: 

• How to determine when information can be considered “personal data” according to the common definitions of the privacy regulation for the European institutions (EUDPR) and the GDPR 
• if and when the pseudonymized data can be considered “personal data” 
• if and when the pseudonymized data made available to a third party can be considered equivalent to anonymous data, from the perspective of that third party. 

The General Court’s decision may be appealed before the CJEU within two months of notification to the parties.

General Court

Formerly known, prior to the entry into force of the Lisbon Treaty, as the Court of First Instance, the General Court is a branch of the Court of Justice of the EU (CJEU) and has jurisdiction to decide disputes brought by individuals or member states against acts or omissions of EU institutions or agencies.

Facts

The Single Resolution Board (SRB) is a body that has been given a centralized resolution power for member states through Regulation (EU) No. 806/2014 on the Single Resolution Mechanism to apply uniform rules and procedures for the resolution of credit institutions and investment firms. Under the powers granted to it, the SRB assesses whether a given credit institution is failing or likely to fail and whether all the criteria for triggering resolution intervention are met by adopting the resolution program.  

The aforementioned regulation stipulates that the interference in property rights by the SRB as a result of the resolution decision should not be excessive. “Accordingly, affected shareholders and creditors should not suffer losses greater than those they would have incurred if the entity had been liquidated at the time the resolution was decided. (…) In order to protect the rights of shareholders and creditors, it is appropriate (that an …) assessment should be conducted of the treatment such shareholders and creditors would have received if the entity had been liquidated under ordinary insolvency proceedings.” 

In the case envisaged here, SRB entrusted this initial assessment to Deloitte as an independent evaluator and, subsequently, transmitted to it the comments received from interested shareholders and creditors, appropriately pseudonymized, without Deloitte being able to re-identify them. The purpose of this second transmission was to allow Deloitte to see whether, the comments received, would result in a change of the previous assessment.