The Court of Justice of the European Union (CJEU) confirms that pseudonymised data can be considered anonymised, while recognising the possibility of anonymisation through pseudo­nymisation techniques. More importantly, the CJEU rules that the anonymised nature of data can be assessed from the perspective of a third party to the data controller and according to the circumstances of the case. The CJEU thus enshrines a relative approach to the concept of personal data and anonymisation.

The challenge for organisations will now be to assess in concrete terms the identifying nature of the data, the risk of re-identification and the nature of the means that could reasonably be used to identify a person. The CJEU is paving the way for greater flexibility in the concepts, but this implies case-by-case analysis and less legal certainty.