Abstract The article analyses whether and how two core concepts of the GDPR require re-evaluation in the aftermath of the decision by the Court of Justice (CJEU) in EDPS v. SRB (C-413/23 P). Therefore, CJEU’s case law (i) on the controller’s transparency obligations and (ii) on the threshold for the qualification as personal data are examined. The examination culminates in two main aspects: (i) Are procedural violations treated differently from substantial violations? (ii) Which elements prove relevant for the qualification as “personal data”, eventually triggering the controller’s transparency obligations.
Frank Ingenrieth (Sun,) studied this question.