CJEU - C-484/24 - NTH Haustechnik

Summary

The Court of Justice of the European Union (CJEU) has ruled that national courts can process personal data presented as evidence, even if that data was initially obtained unlawfully. The court clarified that Article 17(3)(e) of the GDPR, which provides exceptions to the right to erasure, does not serve as an independent legal basis for processing. However, courts can rely on Article 6(1)(c) GDPR (legal obligation) to process such data, provided national law establishes clear conditions, the processing serves a public interest, and is proportionate. The ruling emphasizes that while courts must adhere to data minimization principles, the obligation to assess evidence outweighs concerns about initial unlawful processing.

Full text

Help CJEU - C-484/24 - NTH Haustechnik: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 09:40, 22 October 2025 view sourceAp (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators693 editsmTag: Visual edit← Older edit Latest revision as of 14:36, 22 June 2026 view source Ap (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators693 editsmTag: Visual edit (2 intermediate revisions by the same user not shown)Line 51: Line 51: }}}} The AG opined that the principle of storage limitation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully. The court held that that principle of data minimisation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully and in violation of the initial controller’s information obligations. ==English Summary====English Summary== Line 63: Line 63: # Do national provisions involving an independent judicial processing activity under public interest ([[Article 6 GDPR|Article 6(1)(e) GDPR]]) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party?# Do national provisions involving an independent judicial processing activity under public interest ([[Article 6 GDPR|Article 6(1)(e) GDPR]]) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Can a court rely solely on [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] to process personal data? If yes: # Data processing by a court: ## Does this still apply if the initial data collection is unlawful?## Can a court rely solely on [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] to process personal data? ## Does the principle of fairness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) restrict the applicability of [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]]?## If yes: ## Must [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes?### Does this still apply if the initial data collection is unlawful? ### Does the principle of fairness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) restrict the applicability of [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]]? ### Must [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation?## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation? Line 87: Line 89: === Holding ====== Holding === TBD. ===== '''Question 1: Processing under public interest and the CFREU''' ===== The court first clarified that it assessed the answer to this question in light of [[Article 6 GDPR|Article 6(1)(c) GDPR]] as a legal basis rather than [[Article 6 GDPR|Article 6(1)(e) GDPR]]. This is because the referring court processed data (evidence presented by the parties) in order to comply with its legal obligation of assessing the evidence and making a decision. The court also clarified that it is for national law alone to determine the rules on admissibility and assessment of facts and evidence.<ref>See case C‑511/18, C‑512/18 and C‑520/18 La Quadrature du Net and Others, margin 223 and case C‑140/20 Commissioner of An Garda Síochána and Others, margin 127</ref> The court determined that the GDPR is applicable and that the referring court processed personal data when assessing evidence, in particular when placing documents with personal data in a file. However, the referring court must determine whether the processing in this case falls under the GDPR. The GDPR lays additional requirements for processing under [[Article 6 GDPR|Article 6(1)(c) GDPR]] to be lawful. The court highlighted that [[Article 6 GDPR|Article 6(3) GDPR]] requires the processing to have a legal basis under national law. This legal basis must also meet an objective of public interest and be proportionate to that objective. The court noted that the national law provisions at issue did not lay down conditions in order evidence containing personal data that was subject to earlier unlawful processing to be considered admissible. The court considered that the GDPR does not preclude such national provisions, providing that there is clear and precise national case law that establishes these conditions. Case law must also meet an objective of public interest and be proportionate to that objective.<ref>The court considered the conditions required under the CFREU and ECHR to limit the right to privacy and data protection. The court referred to case law from the ECtHR, which states that the term “law” under Article 8(2) of the ECHR must be understood in a substantive and not formal sense, meaning it may also include case law. See ECtHR, 23 January 2025, H.W. v. France, CE:ECHR:2025:0123JUD001380521, margin 65</ref> ===== '''Question 2: Article 17(3)(e) GDPR as a legal basis to process data''' ===== [[Article 6 GDPR|Article 6(1) GDPR]] sets an exhaustive and restrictive list of legal bases for which a processing activity is considered lawful. The court stated that while [[Article 17 GDPR|Article 17(3)(e) GDPR]] introduces an exception to data subjects’ right to erasure, it does not create an autonomous legal basis for the processing of personal data for the establishment or exercise of legal claims. This Article would be insufficient to comply with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. Therefore, the court considered there was no need to answer the question 2(2) and its sub questions. ===== '''Question 3''' ===== ====== ''Question 3(1): Must the court carry out a comprehensive proportionality test?'' ====== The court highlighted that under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 52(1) CFREU], a limit to the exercise of a fundamental right must meet the requirements of proportionality and necessity. In terms of proportionality, the measure must allow the objectives to be met, the interference must be limited to what is strictly necessary, and there must be a balancing test between the objectives and the seriousness of the interference.<ref>The court noted that the principle of data minimisation (Article 5(1)(c) GDPR gives expression to the principle of proportionality. However, it does not in itself implement the principle (and therefore the conditions needed to fulfil it).</ref> The court noted that a processing activity complies with the first two conditions of proportionality if it complies with the principle of data minimisation. For the third condition, the court stated that, in principle, compliance with [[Article 6 GDPR|Article 6(1) GDPR]] already limits the processing to what is necessary to achieve a legitimate objective. This includes processing with a legitimate interest that outweighs the seriousness of the interference with the fundamental rights under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Articles 7 and 8 CFREU]. Here, the court reiterated that processing under [[Article 6 GDPR|Article 6(1)(c) GDPR]] must also comply with the requirements of [[Article 6 GDPR|Article 6(3) GDPR]]. Therefore, the referring court must comply with the requirements of data minimisation and [[Article 6 GDPR|Article 6(3) GDPR]] (proportionality and balancing of interests). However, the principle of data minimisation does not require the referring court to ensure that the principle of

Entities