ECJ strengthens data protection: Pseudonymization alone is not always enough