The Contextual Nature of the Classification of Pseudonymized Data as Personal Data in European Union Law – a Partially Critical Commentary on the Judgment of the Court of Justice of the European Union of 4 September 2025, C-413/23 P

Abstract

This commentary concerns the judgment of the Court of Justice of the European Union of 4 September 2025 in case C-413/23 P. The commented judgment addresses an important issue, which is the classification pseudonymized data as personal data. The Court held that the assessment of whether pseudonymized data constitute personal data for a given entity is relative. In other words, from the perspective of an entity that does not possess the means enabling the attribution of the data to a specific individual, pseudonymized data received from the controller do not necessarily have the character of personal data. The commentary approves the analysis adopted by the Court with regard to the classification of comments as personal data and the determination of the moment at which the information obligation appears on the controller side pursuant to Article 15 of Regulation 2018/1725. At the same time, the author challenges the distinction between two categories of pseudonymized data: identifiable and non-identifiable, which in the author’s view, results from an incorrect interpretation of the relevant legal articles. In addition, the author disputes the Court’s understanding of identifiability in the present case, as well as the trend towards shifting the boundaries of the relative concept of personal data in the light of pseudonymization and assessing it separately for each entity within the processing chain. As the author explains, such an approach leads to legal uncertainty and undermines the system of personal data protection.