Rethinking Personal Data: New Legal Insights from PROMOT Partner Santa Slokenberga
- Jun 4
- 3 min read
A recent publication by PROMOT partner Santa Slokenberga, co-authored with Line Lundström, is sparking important discussion in the field of data protection law. Published in the Nordic Journal of European Law, the article explores how recent case law—particularly following the SRB case—may reshape how we define “personal data” under European law.
At the heart of this work lies a fundamental question central to the EDPS v. SRB (Case C-413/23 P): Are pseudonymized data invariably considered personal data? The authors challenge the long-standing assumption that they are, offering a more nuanced interpretation with significant implications for research, innovation, and cross-border collaboration.
Why This Matters for PROMOT
PROMOT’s work relies heavily on the responsible use and sharing of sensitive health data, particularly in the context of rare diseases. Data governance frameworks often err on the side of caution, treating pseudonymized data as personal data in all cases. While this approach prioritizes privacy, it can also introduce barriers to efficient data sharing and collaboration across institutions and countries.
Slokenberga and Lundström’s analysis suggests that this cautious default may not always be legally required. Instead, whether pseudonymized data qualify as personal data should depend on the context—specifically, the likelihood that individuals can be re-identified.
This distinction is highly relevant for PROMOT partners working with distributed datasets, registries, and cross-jurisdictional research infrastructures. A clearer understanding of when data fall inside or outside the scope of personal data regulation could help:
Enable more proportionate data governance strategies
Reduce unnecessary administrative burdens
Support faster, more effective collaboration across research sites
Maintain strong privacy protections while facilitating innovation
Key Insight: Context Matters
The article builds on recent legal developments following the EDPS v. SRB case, which examined how data should be assessed from the perspective of the party receiving it. This has important consequences.
Rather than applying a blanket rule, Slokenberga and Lundström argue that:
The classification of data as “personal” should be context-dependent
The means reasonably likely to be used for re-identification must be considered
Different actors may face different legal obligations, depending on their ability to link data back to individuals
In practice, this means that pseudonymized data held by one party may not necessarily be personal data for another, particularly if re-identification is not realistically possible.
A Shift in Thinking
This work challenges a deeply embedded assumption in both legal and research communities. For many, the safest interpretation has been to treat all pseudonymized data as personal data, regardless of context.
However, as Slokenberga explains:
“We need to move beyond one-size-fits-all assumptions. The legal definition of personal data is not static—it depends on context, capabilities, and realistic risks of identification. Recognizing this can help strike a better balance between protecting individuals and enabling socially valuable research.”
This shift in thinking does not weaken data protection. Instead, it encourages more precise and evidence-based interpretations that align legal practice with technological realities and ensure safeguards function as intended.
Implications for Rare Disease Research
For PROMOT and the wider rare disease research community, these findings are particularly timely. Rare disease datasets are often:
Highly sensitive
Distributed across multiple jurisdictions
Dependent on collaboration to achieve meaningful sample sizes
Overly restrictive interpretations of data protection rules can slow progress in areas where time and collaboration are critical.
By clarifying when pseudonymized data may fall outside the strictest regulatory scope, this research opens the door to:
More efficient data sharing frameworks
Improved interoperability between registries
Greater legal certainty for researchers and institutions
At the same time, it reinforces the importance of robust safeguards, ensuring that privacy remains a central priority.
Looking Ahead
This publication is an important contribution to ongoing discussions about the future of data governance in Europe and beyond. As legal interpretations continue to evolve, insights like these will help guide responsible, forward-looking approaches to data use in research. At the same time, further inquiry remains essential, particularly as the definition of personal data under the GDPR is being reconsidered as part of the EU’s Digital Omnibus.
For PROMOT partners, it also highlights the value of interdisciplinary collaboration—bringing together legal expertise and scientific innovation to address complex challenges in rare disease research.
Read More
To explore the full analysis, read the open-access article by Santa Slokenberga and Line Lundström in the Nordic Journal of European Law:
