Pseudonymisation and cyber attacks: addressing article 4(1) GDPR

SRB: Do potential cyber attacks matter when assessing whether pseudonymisation is sufficient to make personal data cease to be “personal” from the perspective of a recipient? Short answer: no, they shouldn’t. Why is that?

In my extensive analysis of the SRB judgment and its practical implications ( https://lnkd.in/e2eNmGUP ), I did not write much about how to determine the effectiveness of pseudonymisation.

Since then, some eminent authors have suggested that it is important to take potential attacks into account, drawing from scientific literature on how pseudonymisation can be defeated through certain cyber attacks.

The issue as I see it? Under CJEU case law, *that should be irrelevant*.

In Breyer, the CJEU made it clear that the idea of means “likely reasonably” to be used in order to identify a data subject is restricted to *legal* means (see §47 & 49). And a cyber attack is quite clearly *not* something that falls within the scope of legal means, notably because of cybercrime provisions but also because of the GDPR itself.

Yes, taking the potential for cyber attacks into account is important in order to assess whether pseudonymisation is an appropriate measure under Article 32 of the GDPR on security – but it should *not* be an appropriate test when assessing pseudonymisation from the perspective of Article 4(1) GDPR.

Any other interpretation would mean that “reasonable” means to identify a data subject no longer are “reasonable”, because they would in fact be unlawful.

So pseudonymisation should be assessed from a dual perspective:

1. Is pseudonymisation sufficiently effective to prevent a recipient of pseudonymised data from getting to identification? If so, the recipient might be able to claim that it has no reasonable means at its disposal to (re)identify the data subject, so *GDPR inapplicable* to it (though it would still be wise to treat it as “potentially personal data”, as I have suggested, to take the CJEU’s Scania judgment and SRB into account in that respect).
[Side note: I still see some claiming that processors could somehow avoid the GDPR’s scope as a result of SRB, a position that I feel is *highly risky*. Please *DO NOT* stop signing data processing agreements without having first an in-depth discussion with a lawyer.]

2. Is pseudonymisation an appropriate measure for Article 32 GDPR compliance? Here, the perspective of malicious actors *can* be taken into account, given that the real issue is not whether the malicious actor is subject to the GDPR but whether the malicious actor can use the data to cause harm.

Happy to read any other views, though I would then appreciate an explanation on how precisely another interpretation would be compatible with the CJEU’s SRB judgment – which incidentally doesn’t mention Art. 33 of the EUI GDPR (= equivalent of Art. 32 GDPR) – and the Breyer judgment.

[And no, the EDPB’s pseudonymisation guidelines don’t prevail over CJEU case law.]

Data protection privacy GDPR