Data protection

The Court of Justice of the European Union (CJEU) has issued an important judgment related to the processing of personal data in administrative procedures, specifically on how and when institutions must inform data subjects about the destination of their data. The case arose from a decision by a banking institution and the process to compensate its shareholders and creditors. Those who wanted to participate in that process had to institutions must inform the affected parties about the fate of their data. The case arose following a resolution by a banking entity and the process to compensate its shareholders and creditors. Those who wanted to participate in that process had to provide documentation and fill out an online form. Subsequently, their comments were transmitted by the Single Resolution Board (SRB) to a consultancy firm, with which it collaborated in assessing the claims.

The point of conflict arises because that information was pseudonymized, that is, it did not directly include the names of the participants, but rather a code that theoretically allowed for identification if other additional information was available. Although the consultancy firm did not have access to direct personal data, the SRB did have all the necessary information to make the connection.

The CJEU clarifies that, in these cases, it must be considered that they are dealing with "personal data" and, therefore, the SRB should have expressly informed the data subjects that their data would be sent to the consultancy firm. In other words, even if there are measures that make identification difficult, if there is a real possibility of doing so (for example, because the data controller has the "key codes"), there is an obligation to notify those providing their data. The matter is not completely settled and returns to a court to review other issues, but the essential message is clear, more transparency and more information for data subjects when their opinions or data may reach third parties, even if indirectly or under pseudonyms.

Our lawyers are at your disposal to defend your rights against actions that contravene the regulations on the protection of personal data if you feel aggrieved.