Case T-557/20 Single Resolution Board v European Data Protection Supervisor (ECLI:EU:T:2023:219)
Based on existing case law, the General Court provides guidance on the examination of the concept of identifiability for the definition of personal data under Article 3(1) of Regulation 2018/17251. The Court has provided clarity with respect to determining the possibility of re-identification of pseudonymised data that has been transferred to a third party with no access to the code key. The possibility of re-identification has to be determined from the perspective of the party that doesn’t have the code key and to whom the data has been transferred to by the data controller.