Understanding when certain data is classified as ‘personal data’, drawing the line between such data and anonymous data, is a task of great importance.
Data protection law applies exclusively to the processing of ‘personal data’, with the result that activities based on anonymous or anonymised data are not subject to the complex legal requirements relating to data protection.
In this regard, the so-called relative approach, according to which the nature of certain information as “personal data” may vary depending on the entity processing it, has long been the subject of debate among scholars in the field. Information that constitutes “personal data” for one entity is not necessarily so for another.
Finally, the EU Court of Justice, in its judgment of 4 September 2025 (case C 413/23 P), which is set to have a significant impact on all activities involving the flow of data between several different parties, has shown its adherence to this concept, providing important clarifications on the notion of “personal data”, the methods for anonymising such data and the relationship between pseudonymisation and anonymisation.
According to the Court, data are not ‘personal’ as such: in order to classify certain data as personal, it is necessary to carry out a specific assessment, verifying whether there is a reasonable likelihood that the controller or third parties will use the means available to identify the persons concerned. If there is an insignificant risk of identification, to be assessed by carefully considering the characteristics of the individual case and the context of reference, the information does not constitute personal data.
The consequences of this approach are disruptive: thanks to the virtuous adoption of the most appropriate legal (e.g., contractual) and technical-IT measures, it is quite possible that certain information, while qualifying as “personal data” for one person, may not be so for another.
The repercussions on pseudonymisation are also significant.
The latter is basically a measure that makes it easier for those who process personal data to comply with legal obligations, but it is not a means of achieving anonymisation. However, according to the Court's guidelines, pseudonymisation can guarantee this result from the point of view of those who only receive pseudonymised data.
In short, it has been clarified that the criteria described above also apply to pseudonymised data: although the latter undoubtedly constitute personal data for the controller who carried out such processing (who, in fact, by definition process also the additional information that allows re-identification), the same data, once communicated to a third party, may be anonymous to the latter. This circumstance occurs when the recipient of the pseudonymised data has no access to the aforementioned additional information, nor does it have any other reasonable means that would allow the re-identification of the data subjects.
The Court's decision is consistent with the promotion of data circulation emerging from the most recent EU regulations (such as the Data Governance Act, Reg. EU 2022/868, and the Data Act, Reg. EU 2023/2854) and greatly facilitates data valorisation through data sharing and reuse.
The ruling prevents any automatic classification of certain data as “anonymous” and highlights, instead, the strategic importance of planning activities involving the processing of personal data.
Only through a thorough assessment of the characteristics of the processing envisaged in each individual case is it possible to identify the legal, organisational and technical measures necessary to obtain anonymous data, which as such are not subject to the GDPR, thereby maximising the possibilities for data exploitation offered by the new EU regulatory framework while respecting the rights of the individuals concerned.
Articoli Correlati