The EU General Court reiterates the relative nature of personal data definitions

Personal data is a relative concept, EU General Court stresses in a new judgment – “it is necessary to put oneself in [the relevant organisation’s] position in order to determine whether the information transmitted to it relates to �identifiable persons�.

The judgment reaffirms the conditional findings of the CJEU in its Breyer judgment (which found that an IP address can be personaldata *if* there are lawful means reasonably likely to be to be used to identify a data subject).

The General Court considers that “it was for the EDPS [= the regulator in question] to examine whether the comments transmitted to Deloitte [= the relevant organisation] constituted personal data for Deloitte” – i.e. that information could only be personal data in relative terms (= relative to the organisation), not in absolute terms.

The General Court continues: “the EDPS is incorrect to maintain that it was not necessary to ascertain whether the authors of the information transmitted to Deloitte were re-identifiable by Deloitte or whether such re-identification was reasonably possible.

In conclusion, “since the EDPS did not investigate whether Deloitte had legal means available to it which could in practice enable it to access the additional information necessary to re-identify the authors of the comments, the EDPS could not conclude that the information transmitted to Deloitte constituted information relating to an �identifiable natural person�”.

The decision concerns Regulation 2018/1725, the GDPR equivalent for EU Institutions, but the concepts and relevant data protection requirements are the same.

Specifically in relation to the GDPR, the Court of Justice itself will be examining this issue once more in case C-604/22.

Judgment (T-557/20): https://lnkd.in/dKPz-A5s
[Last year, the General Court came to a similar conclusion in another judgment in case T?384/20 – see summary and comments here: https://lnkd.in/dEc5jepi ]