Denmark’s data protection authority, Datatilsynet, published additional commentary following the 4 Sept. Court of Justice of the European Union decision in the case of the European Data Protection Supervisor v. the Single Resolution Board that clarified the legal definition of “personal data” in the context of pseudonymization. In light of the decision, the DPA said it considers personal data that is pseudonymized by a controller still constitutes personal data provided it is processed on behalf of the controller according to instructions. The DPA said the processor’s ability to re-identify the data subjects is not relevant under these circumstances because the data processor would be barred from processing personal data, beyond the scope of the existing arrangement with the controller. Editor’s note: IAPP Editorial Director Jedidiah Bracy spoke with Baumgartner Baumann Partner Ulrich Baumgartner, CIPP/E, on a recent episode of The Privacy Advisor Podcast to discuss the CJEU’s ruling.
Full story