The EDPS appealed the General Court’s annulment of his decision which had found that the Single Resolution Board (SRB) breached its informational duties under Art. 15(1)(d) of Regulation 2018/1725, by failing to inform data subjects that their pseudonymised personal data (collected during a right-to-be-heard process in the Banco Popular resolution case) would be transferred to Deloitte.

The CJEU found that the General Court erred in law:

• First, because subjective statements (opinions) submitted by identifiable individuals qualify as personal data under Art. 3(1) of Reg. 2018/1725.
  
• Second, because pseudonymised data may still be personal data for the controller (SRB), even if the recipient (Deloitte) cannot identify the data subjects.
  
• Third, the information obligation under Art. 15(1)(d) must be assessed at the time of data collection, from the perspective of the controller, not the recipient.
  

Thus, the Court set aside the judgment of the General Court, rejected the SRB’s first plea as unfounded, and referred the case back to the General Court for review of the second plea (right to good administration).