A thorny issue for companies has been how to handle data derived from personal information. Is it still personal information? Do privacy laws apply? The EU Court of Justice of grappled with this issue in a September decision. The case arose following a Spanish bank’s financial difficulties. Its regulatory agency, the European Single Resolution Board, stepped in to attempt to value some of the bank’s investments and otherwise determine next steps. As part of the process, the board hired a consulting firm to analyze feedback from the bank’s shareholders and creditors. The board collected the information, pseudonymized the data, and then sent the pseudonymized data set to the consulting firm.
At issue was whether the entity should have told shareholders the sharing with the consulting firm would happen. In other words, treating the pseudonymized data as personal and following notice obligations under a privacy law applicable to entities like the board (Regulation 2018/1725, which is like GDPR but applicable to EU institutions like the board). Which, according to the Court, included telling individuals at the time information was collected, of “potential recipients of that data” (para. 108). The Court held that if pseudonymized data can be combined with other information and identify the individual, it still counts as personal data. The Court noted that this analysis should be made separately for each entity: the original company and the data recipient.
Putting It Into Practice: Knowing when personal information is no longer “personal” will impact what legal obligations apply. As courts -like the one here- often point out, this is a factual analysis, and thus develop proactive processes and procedures can be tricky. In particular, because an entity may not have a full picture of all of the different data flows or intended internal or external uses. Remembering that any organization is made up of individuals with different needs and practices can help. Consider regular check-ins and conversations with business leaders and business teams to understand their current and future data uses and needs.