The Court of Justice of the European Union, in its judgment C-484/24, clarifies the conditions under which a national court may use evidence containing personal data obtained in violation of the GDPR.

Seized by the Higher Labour Court of Lower Saxony in a dispute where an employer, NTH Haustechnik GmbH, had collected data by accessing the private online account of a former employee, the Court rules that the GDPR and the Charter of Fundamental Rights of the European Union do not oppose the use of such evidence. It considers that the processing carried out by a court is necessary to comply with a legal obligation serving the public interest objective of the right to a fair trial. This right must be balanced against the right to data protection, which is not absolute, and the use of the evidence does not constitute a disproportionate interference.

The Court specifies, however, that the court must, before any disclosure, ensure that the data is limited to what is strictly necessary and take measures to reduce the interference. It recalls that the exception to the right to erasure for the defense of rights in legal proceedings (Article 17, paragraph 3, point e) of the GDPR) does not constitute an independent legal basis for processing, which are listed in Article 6. Furthermore, compliance with the data minimization principle (Article 5, paragraph 1, point c) does not require the court to carry out a separate proportionality analysis for each processing. Finally, while the court must comply with the GDPR for third-party data, a party to the dispute cannot invoke a violation committed against them.