Commentary on the Judgment of the Court of Justice of the European Union in European Data Protection Supervisor v. Single Resolution Board (4 September 2025): Relativity of Classification and Unconditional Nature of Obligations
Corresponding Author(s) : Dr. Ahmed Abou-elhasan
Journal of Law and Emerging Technologies,
Vol. 5 No. 1 (2025)
Abstract
في 4 سبتمبر 2025، أصدرت محكمة العدل الأوروبية حكمها في قضية "مفوض حماية البيانات الأوروبي الاتحادي ضد مجلس التسوية الموحد EDPS vs SRB ([1])، وهو حكم شكّل علامة فارقة في مسار تطور مفهوم البيانات الشخصية (personal data)، حيث لعبت المحكمة فيه الدور الأبرز في صياغة هذا التطور.
وفي هذا التعليق، سنتناول الحكم من زاويتين رئيسيتين: أولاً، توضيح الإشكالية القانونية التي تناولها وأثرها على مفهوم حماية البيانات الشخصية؛ وثانياً، استعراض بعض الأحكام السابقة لمحكمة العدل الأوروبية التي ساهمت في تطوير تعريف البيانات الشخصية، في محاولة لفهم طبيعة هذا المفهوم المتطور والمعقد، كما أظهره الحكم محل التعليق، وكما بين هذا الحكم محل التعليق المرن والمتغير أيضا
Download Citation
Endnote/Zotero/Mendeley (RIS)BibTeX
- المراجع باللغة العربية
- (1) الرسائل العلمية (Theses)
- - أحمد عبد العزيز محمد أبو الحسن، النظام القانوني لحماية البيانات الشخصية، رسالة دكتوراه، كلية الحقوق جامعة الإسكندرية، 2022.
- (2) التشريعات (Legislation)
- - الإمارات العربية المتحدة، مرسوم بقانون اتحادي رقم (45) لسنة 2021 بشأن حماية البيانات الشخصية، 2021.
- - جمهورية مصر العربية، قانون رقم ١٥١ لسنة ٢٠٢٠ بإصدار قانون حماية البيانات الشخصية، 2020.
- (3) المنشورات (Publications)
- - الهيئة السعودية للبيانات والذكاء الاصطناعي، الدليل الاسترشادي لإتلاف البيانات الشخصية وإخفاء الهوية والترميز، (s.l.)، (s.n.)، 2024.
- nd English references:
- (1) (Books)
- - Craig P, EU Administrative Law (OUP 2018)
- - Council of Europe and European Union Agency for Fundamental Rights, Handbook on European data protection law: 2018 Edition (Council of Europe 2018)
- - Custers B and others (eds), EU Personal Data Protection in Policy and Practice (Information Technology and Law Series vol 29, Springer 2019)
- - Dibble S, GDPR For Dummies (John Wiley & Son 2019)
- - Hartzog W, Privacy’s Blueprint: The Battle to Control the Design of New Technologies (Harvard University Press 2018
- - Kazemi R, General Data Protection Regulation (GDPR) (Tredition 2018)
- - Klausner M and Golla S, 'Reasonable Expectations of Data Protection in Telerehabilitation-A Legal and Anthropological Perspective on Intelligent Orthoses' in R Leenes and others (eds), Data Protection and Privacy: The Age of Intelligent Machines Computers, Privacy and Data Protection (Bloomsbury 2017)
- - Leenes R and others (eds), Data Protection and Privacy: The Age of Intelligent Machines, Computers, Privacy and Data Protection (Bloomsbury 2017)
- - Wright D and de Hert P (eds), Privacy Impact Assessment (Law, Governance and Technology Series vol 6, Springer 2012)
- (2) (Periodicals)
- - Custers B and others (eds), EU Personal Data Protection in Policy and Practice (Information Technology and Law Series vol 29, Springer 2019)
- - Wright D and de Hert P (eds), Privacy Impact Assessment (Law, Governance and Technology Series vol 6, Springer 2012)
- (2) (Legislation & Treaties)
- - Charter of Fundamental Rights of the European Union [2012] OJ C326/391
- - Treaty on the Functioning of the European Union (Consolidated Version) [2012] OJ C326/47
- - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1
- - Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data
- (3) (Cases)
- - Breyer v Germany Case C-582/14 [2016] OJ C 475/3
- - European Data Protection Supervisor v Single Resolution Board Case C-413/23 P EU:C:2025:645
- - Nowak v Commission App No 31848/96 (ECHR, 11 February 2010)
- - Single Resolution Board v European Data Protection Supervisor Case T-557/20 EU:T:2023:268
- (4) (Publications & Decisions)
- - European Data Protection Supervisor, Decision on five complaints submitted by several complainants against the Single Resolution Board (Cases 2019 947, 2019 998, 2019 999, 2019 1000 and 2019 1122) (24 November 2020) https://www.edps.europa.eu/system/files_de?file=2024-04/0395_2020-1174_001_redacted.pdf accessed 11 November 2025
- (5) (Websites)
- - Court of Justice of the European Union, ‘Court of Justice of the European Union (CJEU)’ (CJEU) https://european-union.europa.eu/institutions-law-budget/institutions-and-bodies/search-all-eu-institutions-and-bodies/court-justice-european-union-cjeu_en accessed 11 November 2025
- - Court of Justice of the European Union, ‘General Court – Overview and Jurisdiction’ (Curia) https://curia.europa.eu/jcms/jcms/Jo2_7033/ accessed 10 November 2025
- - Court of Justice of the European Union, ‘Press release No 117/25’ (Curia, 11 October 2025) https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250117en.pdf accessed 11 October 2025
- - European Central Bank, ‘ECB determined Banco Popular Español S.A. was failing or likely to fail’ (Press Release, 7 June 2017) https://www.bankingsupervision.europa.eu/press/pr/date/2017/html/ssm.pr170607.en.html accessed 8 November 2025
- - European Data Protection Supervisor, ‘About EDPS’ (EDPS) https://www.edps.europa.eu/about-edps_en accessed 6 November 2025
- - NIST, ‘Identifier’ (NIST Glossary) https://csrc.nist.gov/glossary/term/identifier accessed 6 November 2025
- - Single Resolution Board, ‘Banco Popular “right to be heard” process: update’ (SRB) https://www.srb.europa.eu/en/content/banco-popular-right-be-heard-process-update accessed 6 November 2025
- - Single Resolution Board, ‘Banco Popular Español Resolution: the SRB, having received the final “Valuation 3” report...’ (SRB) https://www.srb.europa.eu/en/content/banco-popular-espanol-resolution-srb-having-received-final-valuation-3-report-preparing accessed 8 November 2025
- - Single Resolution Board, ‘Single Resolution Board (EU institution)’ (European Union) https://european-union.europa.eu/institutions-law-budget/institutions-and-bodies/search-all-eu-institutions-and-bodies/single-resolution-board-srb_en accessed 6 November 2025
- - Technology Law, ‘Pseudonymised Data is Not Permission to Share (SRB–EDPS C 413/23 P)’ (Technology Law Blog) https://www.technologylaw.ai/p/pseudonymised-data-is-not-a-permission-to-share-srb-edps-c-413-23-p accessed 6 N
References
المراجع باللغة العربية
(1) الرسائل العلمية (Theses)
- أحمد عبد العزيز محمد أبو الحسن، النظام القانوني لحماية البيانات الشخصية، رسالة دكتوراه، كلية الحقوق جامعة الإسكندرية، 2022.
(2) التشريعات (Legislation)
- الإمارات العربية المتحدة، مرسوم بقانون اتحادي رقم (45) لسنة 2021 بشأن حماية البيانات الشخصية، 2021.
- جمهورية مصر العربية، قانون رقم ١٥١ لسنة ٢٠٢٠ بإصدار قانون حماية البيانات الشخصية، 2020.
(3) المنشورات (Publications)
- الهيئة السعودية للبيانات والذكاء الاصطناعي، الدليل الاسترشادي لإتلاف البيانات الشخصية وإخفاء الهوية والترميز، (s.l.)، (s.n.)، 2024.
nd English references:
(1) (Books)
- Craig P, EU Administrative Law (OUP 2018)
- Council of Europe and European Union Agency for Fundamental Rights, Handbook on European data protection law: 2018 Edition (Council of Europe 2018)
- Custers B and others (eds), EU Personal Data Protection in Policy and Practice (Information Technology and Law Series vol 29, Springer 2019)
- Dibble S, GDPR For Dummies (John Wiley & Son 2019)
- Hartzog W, Privacy’s Blueprint: The Battle to Control the Design of New Technologies (Harvard University Press 2018
- Kazemi R, General Data Protection Regulation (GDPR) (Tredition 2018)
- Klausner M and Golla S, 'Reasonable Expectations of Data Protection in Telerehabilitation-A Legal and Anthropological Perspective on Intelligent Orthoses' in R Leenes and others (eds), Data Protection and Privacy: The Age of Intelligent Machines Computers, Privacy and Data Protection (Bloomsbury 2017)
- Leenes R and others (eds), Data Protection and Privacy: The Age of Intelligent Machines, Computers, Privacy and Data Protection (Bloomsbury 2017)
- Wright D and de Hert P (eds), Privacy Impact Assessment (Law, Governance and Technology Series vol 6, Springer 2012)
(2) (Periodicals)
- Custers B and others (eds), EU Personal Data Protection in Policy and Practice (Information Technology and Law Series vol 29, Springer 2019)
- Wright D and de Hert P (eds), Privacy Impact Assessment (Law, Governance and Technology Series vol 6, Springer 2012)
(2) (Legislation & Treaties)
- Charter of Fundamental Rights of the European Union [2012] OJ C326/391
- Treaty on the Functioning of the European Union (Consolidated Version) [2012] OJ C326/47
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1
- Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data
(3) (Cases)
- Breyer v Germany Case C-582/14 [2016] OJ C 475/3
- European Data Protection Supervisor v Single Resolution Board Case C-413/23 P EU:C:2025:645
- Nowak v Commission App No 31848/96 (ECHR, 11 February 2010)
- Single Resolution Board v European Data Protection Supervisor Case T-557/20 EU:T:2023:268
(4) (Publications & Decisions)
- European Data Protection Supervisor, Decision on five complaints submitted by several complainants against the Single Resolution Board (Cases 2019 947, 2019 998, 2019 999, 2019 1000 and 2019 1122) (24 November 2020) https://www.edps.europa.eu/system/files_de?file=2024-04/0395_2020-1174_001_redacted.pdf accessed 11 November 2025
(5) (Websites)
- Court of Justice of the European Union, ‘Court of Justice of the European Union (CJEU)’ (CJEU) https://european-union.europa.eu/institutions-law-budget/institutions-and-bodies/search-all-eu-institutions-and-bodies/court-justice-european-union-cjeu_en accessed 11 November 2025
- Court of Justice of the European Union, ‘General Court – Overview and Jurisdiction’ (Curia) https://curia.europa.eu/jcms/jcms/Jo2_7033/ accessed 10 November 2025
- Court of Justice of the European Union, ‘Press release No 117/25’ (Curia, 11 October 2025) https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250117en.pdf accessed 11 October 2025
- European Central Bank, ‘ECB determined Banco Popular Español S.A. was failing or likely to fail’ (Press Release, 7 June 2017) https://www.bankingsupervision.europa.eu/press/pr/date/2017/html/ssm.pr170607.en.html accessed 8 November 2025
- European Data Protection Supervisor, ‘About EDPS’ (EDPS) https://www.edps.europa.eu/about-edps_en accessed 6 November 2025
- NIST, ‘Identifier’ (NIST Glossary) https://csrc.nist.gov/glossary/term/identifier accessed 6 November 2025
- Single Resolution Board, ‘Banco Popular “right to be heard” process: update’ (SRB) https://www.srb.europa.eu/en/content/banco-popular-right-be-heard-process-update accessed 6 November 2025
- Single Resolution Board, ‘Banco Popular Español Resolution: the SRB, having received the final “Valuation 3” report...’ (SRB) https://www.srb.europa.eu/en/content/banco-popular-espanol-resolution-srb-having-received-final-valuation-3-report-preparing accessed 8 November 2025
- Single Resolution Board, ‘Single Resolution Board (EU institution)’ (European Union) https://european-union.europa.eu/institutions-law-budget/institutions-and-bodies/search-all-eu-institutions-and-bodies/single-resolution-board-srb_en accessed 6 November 2025
- Technology Law, ‘Pseudonymised Data is Not Permission to Share (SRB–EDPS C 413/23 P)’ (Technology Law Blog) https://www.technologylaw.ai/p/pseudonymised-data-is-not-a-permission-to-share-srb-edps-c-413-23-p accessed 6 N