CLAIM-2026-09-15-06

In EDPS v SRB, Case C-413/23 P, decided 4 September 2025, the Court of Justice held that the transmitting controller's duty to inform applied before the transfer regardless of whether the recipient could identify the data subjects, and that identifiability is assessed from the controller's point of view at the time of collection.

Why it matters

It removes the argument that downstream redaction cures an upstream disclosure failure. The duty is fixed at the moment you collect, from where you stand.

Sources

• courtofjust2025edps