How can the recent EU Court of Justice ruling regarding the definition of personal data facilitate research involving pseudonymized data?

December 11, 2025

How can the recent EU Court of Justice ruling regarding the definition of personal data facilitate research involving pseudonymized data?

Access to health data is essential to all research. This is especially the case in fields where data has historically been limited, such as Adolescent and Young Adult (AYA) cancer, where access to robust and granular data is crucial for driving advancement and promoting equitable progress. However, this must always be balanced with respect for patients’ rights over their personal information. At STRONG-AYA, we give high priority to protecting patients’ privacy. Our approach focuses on utilizing federated learning, a decentralized data sharing technique which allows us to develop insights from aggregated data without making individual-level data visible (more information can be found on our website).

In the European Union, the General Data Protection Regulation (GDPR), which came into effect in 2018, provides an invaluable framework for the responsible handling of personal data that aims to protect the individuals from which that data is collected. Unfortunately, its implementation has sometimes led to legal uncertainty when conducting international research projects such as ours, creating unintended roadblocks. Central to the GDPR is the concept of “personal data”, as only this category of data is subject to the strict requirements of the GDPR. Previously, it was assumed that, while anonymized data escaped the “personal data” classification, pseudonymized data did not.

Pseudonymized data is personal data from which identifiable components, such as name, address, or date of birth, are removed or obscured. Pseudonymization differs from anonymization: while the former could be linked back to individuals with the use of additional information, the latter cannot – it is an irreversible process. In that sense, anonymization grants patients the highest level of privacy. However, it also makes their data much less valuable for research, as it prevents updates of patient information and strips it of important contextual information. Consequently, most of the data used in health research, and the data stored by our local partners prior to aggregation is pseudonymized rather than anonymized. However, there remained uncertainty concerning whether the aggregation techniques used in STRONG-AYA were sufficient in de-identifying the data to the point it could be considered anonymous and thus outside the scope of the GDPR. This situation changed with a recent Court of Justice of the European Union (CJEU) ruling (C-413/23 P | EDPS v SRB).

In EDPS v SRB, the CJEU provided much needed clarification on the concept of personal data, ruling that pseudonymized data does not always qualify as personal data. Instead, if pseudonymized data is shared with a third party that does not have the means to link it back to individual data subjects, then it does not qualify as personal data under the GDPR:

“Pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data (…), in so far as pseudonymisation may, depending on the circumstances of the case, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable” (para. 86).

This new understanding of what constitutes personal data simplifies legal compliance for data users such as researchers and policymakers by reducing legal uncertainty. However, one could wonder whether this ruling, taken in the broader context of the recent AI and data protection deregulation trend, sufficiently considers the best interests of individuals. Even when pseudonymized data isn’t considered personal data, sharing it should be done with great caution, especially in cases such as ours where the information is sensitive and patients are rare, thus more vulnerable to reidentification. Researchers should consequently remain committed to ethical guidelines such as transparency and accountability even when not legally bound by them.

Nevertheless, the ruling represents a great leap forward for research involving pseudonymized data. By reducing legal ambiguity, it facilitates data sharing across institutions and countries, thus broadening access to vital data for researchers. It confirms that our approach, using Federated Learning and secure data aggregation, meets the necessary legal standards to allow for simplified cross-border data sharing and reuse. Ultimately, this decision will encourage greater collaboration among data holders, fostering responsible data reuse and driving research, innovation and evidence-based policymaking.

Written by Marine Jacquemin (Maastricht University), Leonard Wee (Maastricht University), and Urška Košir (Youth Cancer Europe)