A Review of the EDPB’s Anonymization Guidelines in Light of EDPS v SRB

1. The EDPS’s Investigation and Decisions Concerning SRB

Following Banco Popular’s resolution, the Single Resolution Board (SRB) invited affected shareholders and creditors to comment on its preliminary compensation assessment. During registration, SRB verified their identities and status. During consultation, participants submitted comments associated with unique alphanumeric codes. SRB transmitted valuation-related comments to Deloitte, retaining the additional information linking the codes to individuals. Neither Deloitte nor the SRB staff assessing the comments could access that information.

Five complaints alleged that SRB’s privacy statement did not identify Deloitte as a recipient. SRB argued that the comments contained views on the valuation rather than personal information and, alternatively, that Deloitte could not identify their authors.

Relying on Nowak, the European Data Protection Supervisor (EDPS) considered that subjective opinions could relate to their authors. It treated the comments as pseudonymized personal data under Regulation (EU) 2018/1725, reasoning that additional identifying information existed and that its retention by another entity did not make the comments anonymous. The EDPS found an infringement of the obligation to provide information but, considering SRB’s safeguards, exercised no corrective powers.

2. SRB’s Action for Annulment Before the General Court

SRB challenged the EDPS’s interpretation of personal data and alleged an infringement of the right to good administration. The General Court held the action admissible despite the absence of corrective measures, because the finding of an infringement could have future legal consequences.

The General Court accepted that opinions may constitute personal data but held that the EDPS had not sufficiently examined whether the comments related to individuals by reason of their content, purpose or effect. The General Court required an assessment of Deloitte’s means of identifying the authors. It held that the additional information was the database linking codes to individuals, rather than the codes themselves. Applying Breyer, it explained that the risk of identification may be insignificant where identification is prohibited by law or practically impossible because it requires disproportionate time, cost and manpower. The Court therefore also relied on the EDPS’s failure to examine Deloitte’s position in annulling the decision.

3. Proceedings Before the CJEU

The EDPS appealed, supported by the EDPB; the European Commission intervened in support of SRB.

Whether the Information Related to a Natural Person: The CJEU held that content, purpose and effect are alternative, rather than cumulative, conditions. It found that, since the comments expressed their authors’ personal views, the EDPS had already assessed their content and did not need a separate examination of purpose or effect.

Identifiability: The CJEU held that pseudonymized data are not necessarily personal data for every entity. It explained that the comments remained personal data for SRB because it retained the additional information, but could lose that status for Deloitte if safeguards that Deloitte could not overcome effectively prevented it from attributing the comments to individuals. The Court reiterated that the assessment must consider all means reasonably likely to be used and that the risk of identification may be insignificant where identification is prohibited by law or practically impossible.

The Obligation to Provide Information: The CJEU held that, for the obligation to provide information, identifiability must be assessed at collection from the controller’s perspective. Accordingly, SRB had to inform data subjects about Deloitte before transmission, irrespective of the comments’ subsequent status for Deloitte. The CJEU therefore did not finally determine that status. It set aside the General Court’s judgment, rejected SRB’s first plea and referred the case back for examination of the plea alleging an infringement of the right to good administration.

On 6 November 2025, SRB notified the General Court that it wished to withdraw its action. The dispute concerning the obligation to provide information had been resolved; only the good administration plea remained outstanding.

4. The EDPB’s Anonymization Guidelines

The draft updates the Article 29 Working Party’s Opinion 05/2014 on Anonymization Techniques, placing greater emphasis on legal criteria and case law.

4.1 Points Reflecting the CJEU’s Case Law

The EDPB recognizes that information may be anonymous for one entity but personal data for another. It calls for a contextual assessment of means reasonably likely to be used, rather than every theoretical possibility, and states that identification risk need not be zero but must be insignificant. The draft also reiterates the content, purpose or effect test. The EDPB distinguishes legal prohibitions from contractual restrictions, noting that the latter may be amended or breached.

4.2 Points Departing from or Extending Beyond the CJEU’s Case Law

The Controller and Processor Relationship: The EDPB states that whether data are personal for an entity processing on behalf of a controller must be assessed from that controller’s perspective, treating the data as personal for both. The CJEU did not expressly impose this distinction based on the parties’ roles.

• Our view: The assessment of identifiability should follow the definition of personal data and the entity’s capabilities, independently of its role. Although the controller–processor relationship was raised before the CJEU, the Court did not treat the parties’ roles as a criterion for determining the relevant perspective.

Considering Unlawful Means: The EDPB states that unlawful means may be considered where sufficient evidence establishes a concrete risk that they are reasonably likely to be used. It identifies factors such as ineffective enforcement, benefits outweighing costs and risks, inadequately protected additional information and previous violations. It also notes that relevant entities may include unauthorized or malicious actors.

• Our view: Presuming in advance that an entity will act unlawfully and, on that basis, including unlawful means in the assessment of re-identification risk is not a legally sound approach. The likelihood of unlawful conduct is inherently difficult to assess objectively and consistently. Serious indications of such conduct by a data recipient should raise broader data protection concerns beyond re-identification risk.

Other Obligations in the Anonymization Process: The EDPB states that anonymization requires a lawful basis, information to data subjects and documentation. It notes that early anonymization and deletion of original data may favor the controller in a legitimate interests balancing test, and that personal data breaches may require reassessment. These issues extend beyond the obligation to provide information expressly addressed in EDPS v SRB. The EDPB also states that, where data are anonymous for the recipient but remain personal for the anonymizing controller, the controller must comply with all applicable GDPR obligations.

4.3 Criteria Established by the EDPB

a. The three criteria

• No Record Isolation criterion tests whether records contain unique combinations of attributes relating to a single individual.
• No Linkage criterion tests whether records relating to the same individual can be linked across datasets.
• No Inference criterion tests whether specific and meaningful information can be inferred about an identified or identifiable individual, with potential effects on their rights or interests.

b. Application of the criteria under two approaches

• The contextual approach assesses each relevant entity’s capabilities and circumstances. The EDPB cautions that incomplete information may produce false positives: data are considered anonymous although identification remains possible.
• The simplified approach does not distinguish entities’ capabilities and may produce false negatives: genuinely anonymous data are treated as personal data. Under either approach, the EDPB considers that meeting all three criteria supports anonymity; failure requires further analysis of the circumstances, including whether individuals can be singled out.

Our view: Contextual assessment better reflects CJEU case law where recipients and their capabilities are known. The simplified approach may assist where these cannot be established, but hypothetical assumptions and the interaction between the approaches may create additional complexity.

Recommendation

5. Conclusion

EDPS v SRB established the legal framework for assessing when, and for whom, pseudonymized data remain personal data, creating a need for more concrete criteria for its practical application. The EDPB’s draft Guidelines largely reflect this framework but, in our view, depart from it in certain respects, potentially undermining the Court’s contextual, entity-specific identifiability test.

Although practical criteria are welcome, interpretations that diverge from CJEU case law may create uncertainty and lead to further litigation. We expect the final Guidelines, following public consultation, to address these concerns and align more closely with the Court’s approach.

Article provided by INPLP members: Bora Yazıcıoğlu and İbrahim Yıldırım (YAZICIOGLU Legal, Turkey)