The withdrawal of the SRB case: why the CJEU approach to pseudonymisation continues to serve as the de facto standard
In recent months, the European privacy community had been closely following the case that had been brought before the General Court of the European Union by the Single Resolution Board (SRB). That case had the potential to bring further clarity to the question of when data should be considered personal data and how pseudonymisation fits into this.
The case was unexpectedly withdrawn, however. This means that the existing, transparent approach of the Court of Justice of the European Union (CJEU) remains fully intact. And that is welcome news for organisations that wish to share data responsibly and securely — provided they implement pseudonymisation correctly.
As a Trusted Third Party (TTP), Viacryp sees first-hand, and on a daily basis, just how crucial that clarity is. In this article, we explain what the withdrawal means, why the CJEU approach remains so important, and how pseudonymisation helps organisations to share data without processing personal data. We conclude with a concrete example from the healthcare sector, where data sharing is necessary to combat fraud.
What was the SRB case about?
The SRB case revolved around the question of whether certain pseudonymised data should still be classified as personal data when the receiving party itself had no way of identifying the individuals concerned. The SRB argued that the data was effectively anonymous to the receiving party.
However, the case was withdrawn before the Court could rule on it. As a result, the recent clarification by the CJEU regarding pseudonymisation and the definition of personal data by the Court of Justice remains authoritative.
What exactly does the CJEU say about pseudonymisation?
The CJEU is clear: Data is only personal data for a party that has a reasonable ability to identify a person.
This means:
- if a party does not have access to the additional information needed to trace a pseudonym back to a person …
- … and cannot reasonably obtain such access …
- … then the data is not personal data for that party.
This nuance is crucial. It means that pseudonymisation — if done properly — can render data pseudonymous for the receiving party, which, in turn, means that the processing falls outside the scope of the GDPR.
However, pseudonymisation must meet strict conditions. And that is precisely where Viacryp comes in.
How Viacryp applies pseudonymisation: separation, splitting, and control
Viacryp’s pseudonymisation process is well designed and appears to meet the requirements set by the CJEU. The core principles are:
- Splitting of data (who vs. what)
Identifiable data (the ‘who’) is separated from behavioural or analytical data (the ‘what’) early in the process. - Separation of responsibilities
1. The source retains the original personal data.
2. Viacryp only receives hashed identifiers.
3. The recipient only receives pseudonyms and encrypted behavioural data. - No single party can solve the puzzle alone
Through hashing, encryption, and strict organisational separation, no party other than the source can reconstruct the identity of the data subject. - Non-repeatability (anti-replay)
Hashing and encryption are performed in such a way that the same input never automatically produces the same output. - Independent audits and complete transparency
The workings of the pseudonymisation process are publicly documented and periodically audited.
The result is that the recipient is provided with data that does not constitute personal data for them. This is precisely what the CJEU refers to.
It should be noted that, naturally, this depends on how traceable the data in the behaviour is. Careful consideration must be given to any data that is to be sent and linked.
Why this is relevant to data sharing: an example involving healthcare fraud
A recent LinkedIn discussion highlighted a very real problem: fraud in the healthcare sector. Various parties — health insurers, local authorities, regulators — have access to fragments of information that, when combined, could reveal a pattern of fraud; however, they are not allowed to share this information with each other, as it often involves personal data.
This is precisely the kind of situation in which pseudonymisation can make all the difference.
How pseudonymisation can help in such a scenario:
- Each party submits its data through a supply module
Identifying data is hashed; behavioural data is encrypted. - Viacryp combines the datasets based on pseudonyms
Viacryp does this without ever having access to the original personal data. - The recipients receive pseudonymised, decrypted behavioural data
They can recognise patterns, analyse risks, and detect fraud. - No one has access to personal data
The source remains the only party that knows the identity of the data subject.
What does this mean from a legal perspective?
For the recipients, the data is no longer personal data because:
- they do not have access to the additional information (the key),
- they cannot reasonably obtain that information,
- and the pseudonymisation is technically and organisationally robust.
This allows parties to work together to combat fraud without violating the GDPR.
Conclusion: the withdrawal confirms the status quo, which is good news
The withdrawal of the SRB case does not change the legal reality: The CJEU approach remains the de facto standard, and it allows for responsible data sharing through robust pseudonymisation.
For organisations that want to collaborate without sharing personal data — such as in healthcare, the social services domain, the financial sector, or the public sector — this is confirmation that pseudonymisation, if done correctly, is a legally sound and technically secure route.
Viacryp remains committed to making that route accessible, transparent, and reliable.
