The Privacy Advisor Podcast Personal data defined? Ulrich Baumgartner on the implications of the CJEU's SRB ruling
12 snips
Oct 10, 2025 Ulrich Baumgartner, a partner at Baumgartner Baumann and data protection expert, discusses the landmark CJEU ruling on personal data. He unpacks the shift from an absolutist to a relative approach to identifiability, clarifying implications for GDPR compliance. The conversation touches on pseudonymization, the needed revisions in EDPB guidance, and the potential impacts on data processing agreements. Baumgartner also highlights the emerging relevance of privacy-enhancing technologies as legal definitions evolve, offering actionable insights for data professionals.
AI Snips
Chapters
Transcript
Episode notes
Court Confirms Relative Identifiability
- The CJEU reaffirmed a relative approach: identifiability depends on the processor's means, not on any third party's ability to identify.
- This settles long debate and restricts overly broad 'absolute' regulator interpretations.
Document Pseudonymization And Recipient Ability
- If you pseudonymize data before sharing with a party that cannot re-identify, treat that recipient's data as anonymized for GDPR purposes.
- Still document the analysis because controllers may remain responsible for information duties about recipients.
Burden Of Proof Remains Unresolved
- The court left burden-of-proof unclear, creating legal uncertainty about who must prove identifiability.
- That uncertainty will shape future disputes between controllers and supervisory authorities.