What you may have missed in the CJEU appellate judgment on the OLAF case

With the IAB Europe judgment and some others, you may have missed the CJEU’s appellate judgment in the OLAF case on the EUI GDPR – which (also) deals with the concept of “personal data”. Here is my take:

First, the EUI GDPR – Regulation 2018/1725 – is extremely similar to the GDPR itself, also as regards the notion of “personal data”. So relevant data protection judgment!

Next, the legal reasoning is similar to the CJEU’s reasoning in Question 1 of the TCF case (“Is the TC String personal data?” – see my comments here: https://lnkd.in/enTPn35W ). Paragraphs 45-48 of this judgment are even rephrased versions of paragraphs 35-39 of the IAB Europe judgment, with references to the same case law (and Breyer in particular).

We get new stuff from para. 49 onwards:

“49 […] the fact that additional information is necessary to identify the data subject does not mean that the data at issue cannot be classified as personal data […].

“50 It is also necessary, however, that the possibility of combining the data in question with additional information constitutes a means reasonably likely to be used to identify the data subject. To ascertain whether means are reasonably likely to be used in order to identify a natural person, account should be taken […] of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

=> Some info can be personal data even if you need additional data to make identification possible, *but* that requires the availability of means reasonably likely to be used

“51�[…] the Court has already held that a means is not reasonably likely to be used to identify the data subject where the identification of that person is prohibited by law or impossible in practice, on account of the fact that it requires a disproportionate effort in terms of time, cost and labour, so that the risk of identification appears in reality to be insignificant

=> Disproportionate effort = not a “means reasonably likely to be used

*BUT* such additional information could come from a third party *OR* the person capable of identifying the person might be someone else (para. 55-56)

Here, because of the public nature of the press release in question, the audience was broad and included (investigative) journalists + people “working in the same scientific field and familiar with that person�s professional background”, who might be able to identify the person who was unnamed in the relevant press release without “disproportionate” effort (59-60-63) => the Breyer judgment “does not allow the risk of identification of the data subject to be regarded as insignificant” (61).

The lesson?
“Means reasonably likely to be used” remains critical – so nothing is automatically personal data. (see also Breyer & IAB/TCF rulings)
Again, not the privacy victory some might claim ??

Judgment: https://lnkd.in/dztyb9g9