[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f07RRrnopiX-fhfXNAR8DNxbfjKJzsRjwAdyHia0mifI":3},{"article":4,"iocs":38},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"4d874f3e-31ec-4d78-9bef-a538a45b917c","CJEU - C-484\u002F24 - NTH Haustechnik","cjeu-c-484-24-nth-haustechnik-7ffa97","← Older revision Revision as of 14:36, 22 June 2026 (2 intermediate revisions by the same user not shown) Line 51: Line 51: }} }} The AG opined that the principle of storage limitation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully. The court held that that principle of data minimisation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully and in violation of the initial controller’s information obligations. ==English Summary== ==English Summary== Line 63: Line 63: # Do national provisions involving an independent judicial processing activity under public interest ([[Article 6 GDPR|Article 6(1)(e) GDPR]]) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Do national provisions involving an independent judicial processing activity under public interest ([[Article 6 GDPR|Article 6(1)(e) GDPR]]) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Can a court rely solely on [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] to process personal data? If yes: # Data processing by a court: ## Does this still apply if the initial data collection is unlawful? ## Can a court rely solely on [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] to process personal data? ## Does the principle of fairness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) restrict the applicability of [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]]? ## If yes: ## Must [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? ### Does this still apply if the initial data collection is unlawful? ### Does the principle of fairness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) restrict the applicability of [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]]? ### Must [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation? ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation? Line 87: Line 89: === Holding === === Holding === TBD. ===== '''Question 1: Processing under public interest and the CFREU''' ===== The court first clarified that it assessed the answer to this question in light of [[Article 6 GDPR|Article 6(1)(c) GDPR]] as a legal basis rather than [[Article 6 GDPR|Article 6(1)(e) GDPR]]. This is because the referring court processed data (evidence presented by the parties) in order to comply with its legal obligation of assessing the evidence and making a decision. The court also clarified that it is for national law alone to determine the rules on admissibility and assessment of facts and evidence. See case C‑511\u002F18, C‑512\u002F18 and C‑520\u002F18 La Quadrature du Net and Others, margin 223 and case C‑140\u002F20 Commissioner of An Garda Síochána and Others, margin 127 The court determined that the GDPR is applicable and that the referring court processed personal data when assessing evidence, in particular when placing documents with personal data in a file. However, the referring court must determine whether the processing in this case falls under the GDPR. The GDPR lays additional requirements for processing under [[Article 6 GDPR|Article 6(1)(c) GDPR]] to be lawful. The court highlighted that [[Article 6 GDPR|Article 6(3) GDPR]] requires the processing to have a legal basis under national law. This legal basis must also meet an objective of public interest and be proportionate to that objective. The court noted that the national law provisions at issue did not lay down conditions in order evidence containing personal data that was subject to earlier unlawful processing to be considered admissible. The court considered that the GDPR does not preclude such national provisions, providing that there is clear and precise national case law that establishes these conditions. Case law must also meet an objective of public interest and be proportionate to that objective. The court considered the conditions required under the CFREU and ECHR to limit the right to privacy and data protection. The court referred to case law from the ECtHR, which states that the term “law” under Article 8(2) of the ECHR must be understood in a substantive and not formal sense, meaning it may also include case law. See ECtHR, 23 January 2025, H.W. v. France, CE:ECHR:2025:0123JUD001380521, margin 65 ===== '''Question 2: Article 17(3)(e) GDPR as a legal basis to process data''' ===== [[Article 6 GDPR|Article 6(1) GDPR]] sets an exhaustive and restrictive list of legal bases for which a processing activity is considered lawful. The court stated that while [[Article 17 GDPR|Article 17(3)(e) GDPR]] introduces an exception to data subjects’ right to erasure, it does not create an autonomous legal basis for the processing of personal data for the establishment or exercise of legal claims. This Article would be insufficient to comply with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. Therefore, the court considered there was no need to answer the question 2(2) and its sub questions. ===== '''Question 3''' ===== ====== ''Question 3(1): Must the court carry out a comprehensive proportionality test?'' ====== The court highlighted that under [https:\u002F\u002Fwww.europarl.europa.eu\u002Fcharter\u002Fpdf\u002Ftext_en.pdf Article 52(1) CFREU], a limit to the exercise of a fundamental right must meet the requirements of proportionality and necessity. In terms of proportionality, the measure must allow the objectives to be met, the interference must be limited to what is strictly necessary, and there must be a balancing test between the objectives and the seriousness of the interference. The court noted that the principle of data minimisation (Article 5(1)(c) GDPR gives expression to the principle of proportionality. However, it does not in itself implement the principle (and therefore the conditions needed to fulfil it). The court noted that a processing activity complies with the first two conditions of proportionality if it complies with the principle of data minimisation. For the third condition, the court stated that, in principle, compliance with [[Article 6 GDPR|Article 6(1) GDPR]] already limits the processing to what is necessary to achieve a legitimate objective. This includes processing with a legitimate interest that outweighs the seriousness of the interference with the fundamental rights under [https:\u002F\u002Fwww.europarl.europa.eu\u002Fcharter\u002Fpdf\u002Ftext_en.pdf Articles 7 and 8 CFREU]. Here, the court reiterated that processing under [[Article 6 GDPR|Article 6(1)(c) GDPR]] must also comply with the requirements of [[Article 6 GDPR|Article 6(3) GDPR]]. Therefore, the referring court must comply with the requirements of data minimisation and [[Article 6 GDPR|Article 6(3) GDPR]] (proportionality and balancing of interests). However, the principle of data minimisation does not require the referring court to ensure that the principle of proportionality is observed for every processing of personal data it undertakes. ====== ''Questions 3(2) to (4): can a court process data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully?'' ====== The court first referred to the AG’s opinion, and stated that the GDPR does not lay an absolute prohibition preventing a public authority from taking into account personal data that was previously unlawfully processed by the person who transmitted the data to such authority. The court stated that a court has the obligation to rule on whether evidence presented by parties is admissible and to take said evidence into account to reach a decision (in accordance with national law). The processing of personal data carried out by a court in connection to these obligations is, in principle, necessary. These obligations do not appear to contradict the requirements set in [[Article 6 GDPR|Articles 6(1)(c) and 6(3) GDPR]]. Therefore, the principle of data minimisation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully. The court took into account the importance of the right to fair trial ([https:\u002F\u002Fwww.europarl.europa.eu\u002Fcharter\u002Fpdf\u002Ftext_en.pdf Article 47 CFREU]), and concluded that processing of personal data was not a disproportionate interference with the fundamental right to privacy and data protection. The court noted that no other measure appeared to be capable of achieving the objective as effectively as allowing courts to process personal data found in evidence presented by parties. Nonetheless, the court noted that the data processed must be limited to what is adequate, relevant and necessary, in accordance with the principle of data minimisation. Here the court made a distinction between assessing the admissibility of evidence and using that evidence to reach a decision; assessing all evidence does not infringe the principle of data minimisation. However, after finding the admissible evidence, the court must take measures to reduce the amount of data processed before placing it on file (e.g. by anonymising documents where possible). This data placed on file must, in principle, be considered to be compliant with the principle of data minimisation. Finally, when disclosing the data (e.g. when publishing the decision), the court must again limit the data processing to what is necessary for its purpose(s). ====== ''Question 3(5): does the previous question also apply to data processed in violation of the initial controller's information obligations?'' ====== Similarly, the court stated that [[Article 13 GDPR|Articles 13(1) and (2) GDPR]] do not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed in violation of the initial controller’s information obligation. The court reiterated that the GDPR does not lay an absolute prohibition on processing data that was previously unlawfully processed. Therefore, the fact that the controller did not comply with its obligations under the GDPR did not mean that transferring the evidence with personal data is unlawful. ====== ''Question 3(6): the court's obligations when processing data of persons who are not a party to the proceedings'' ====== Finally, the court stated that a court is required, when acting in its judicial capacity, to ensure compliance with the GDPR when processing the personal data of persons who are not a party to the proceedings. == Comment == == Comment ==","The Court of Justice of the European Union (CJEU) has ruled that national courts can process personal data presented as evidence, even if that data was initially obtained unlawfully. The court clarified that Article 17(3)(e) of the GDPR, which provides exceptions to the right to erasure, does not serve as an independent legal basis for processing. However, courts can rely on Article 6(1)(c) GDPR (legal obligation) to process such data, provided national law establishes clear conditions, the processing serves a public interest, and is proportionate. The ruling emphasizes that while courts must adhere to data minimization principles, the obligation to assess evidence outweighs concerns about initial unlawful processing.","CJEU rules national courts can process unlawfully obtained personal data as evidence.","Help CJEU - C-484\u002F24 - NTH Haustechnik: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 09:40, 22 October 2025 view sourceAp (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators693 editsmTag: Visual edit← Older edit Latest revision as of 14:36, 22 June 2026 view source Ap (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators693 editsmTag: Visual edit (2 intermediate revisions by the same user not shown)Line 51: Line 51: }}}} The AG opined that the principle of storage limitation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully. The court held that that principle of data minimisation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully and in violation of the initial controller’s information obligations. ==English Summary====English Summary== Line 63: Line 63: # Do national provisions involving an independent judicial processing activity under public interest ([[Article 6 GDPR|Article 6(1)(e) GDPR]]) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party?# Do national provisions involving an independent judicial processing activity under public interest ([[Article 6 GDPR|Article 6(1)(e) GDPR]]) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Can a court rely solely on [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] to process personal data? If yes: # Data processing by a court: ## Does this still apply if the initial data collection is unlawful?## Can a court rely solely on [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] to process personal data? ## Does the principle of fairness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) restrict the applicability of [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]]?## If yes: ## Must [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes?### Does this still apply if the initial data collection is unlawful? ### Does the principle of fairness ([[Article 5 GDPR|Article 5(1)(a) GDPR]]) restrict the applicability of [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]]? ### Must [[Article 17 GDPR#3e|Article 17(3)(e) GDPR]] be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation?## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation? Line 87: Line 89: === Holding ====== Holding === TBD. ===== '''Question 1: Processing under public interest and the CFREU''' ===== The court first clarified that it assessed the answer to this question in light of [[Article 6 GDPR|Article 6(1)(c) GDPR]] as a legal basis rather than [[Article 6 GDPR|Article 6(1)(e) GDPR]]. This is because the referring court processed data (evidence presented by the parties) in order to comply with its legal obligation of assessing the evidence and making a decision. The court also clarified that it is for national law alone to determine the rules on admissibility and assessment of facts and evidence.\u003Cref>See case C‑511\u002F18, C‑512\u002F18 and C‑520\u002F18 La Quadrature du Net and Others, margin 223 and case C‑140\u002F20 Commissioner of An Garda Síochána and Others, margin 127\u003C\u002Fref> The court determined that the GDPR is applicable and that the referring court processed personal data when assessing evidence, in particular when placing documents with personal data in a file. However, the referring court must determine whether the processing in this case falls under the GDPR. The GDPR lays additional requirements for processing under [[Article 6 GDPR|Article 6(1)(c) GDPR]] to be lawful. The court highlighted that [[Article 6 GDPR|Article 6(3) GDPR]] requires the processing to have a legal basis under national law. This legal basis must also meet an objective of public interest and be proportionate to that objective. The court noted that the national law provisions at issue did not lay down conditions in order evidence containing personal data that was subject to earlier unlawful processing to be considered admissible. The court considered that the GDPR does not preclude such national provisions, providing that there is clear and precise national case law that establishes these conditions. Case law must also meet an objective of public interest and be proportionate to that objective.\u003Cref>The court considered the conditions required under the CFREU and ECHR to limit the right to privacy and data protection. The court referred to case law from the ECtHR, which states that the term “law” under Article 8(2) of the ECHR must be understood in a substantive and not formal sense, meaning it may also include case law. See ECtHR, 23 January 2025, H.W. v. France, CE:ECHR:2025:0123JUD001380521, margin 65\u003C\u002Fref> ===== '''Question 2: Article 17(3)(e) GDPR as a legal basis to process data''' ===== [[Article 6 GDPR|Article 6(1) GDPR]] sets an exhaustive and restrictive list of legal bases for which a processing activity is considered lawful. The court stated that while [[Article 17 GDPR|Article 17(3)(e) GDPR]] introduces an exception to data subjects’ right to erasure, it does not create an autonomous legal basis for the processing of personal data for the establishment or exercise of legal claims. This Article would be insufficient to comply with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. Therefore, the court considered there was no need to answer the question 2(2) and its sub questions. ===== '''Question 3''' ===== ====== ''Question 3(1): Must the court carry out a comprehensive proportionality test?'' ====== The court highlighted that under [https:\u002F\u002Fwww.europarl.europa.eu\u002Fcharter\u002Fpdf\u002Ftext_en.pdf Article 52(1) CFREU], a limit to the exercise of a fundamental right must meet the requirements of proportionality and necessity. In terms of proportionality, the measure must allow the objectives to be met, the interference must be limited to what is strictly necessary, and there must be a balancing test between the objectives and the seriousness of the interference.\u003Cref>The court noted that the principle of data minimisation (Article 5(1)(c) GDPR gives expression to the principle of proportionality. However, it does not in itself implement the principle (and therefore the conditions needed to fulfil it).\u003C\u002Fref> The court noted that a processing activity complies with the first two conditions of proportionality if it complies with the principle of data minimisation. For the third condition, the court stated that, in principle, compliance with [[Article 6 GDPR|Article 6(1) GDPR]] already limits the processing to what is necessary to achieve a legitimate objective. This includes processing with a legitimate interest that outweighs the seriousness of the interference with the fundamental rights under [https:\u002F\u002Fwww.europarl.europa.eu\u002Fcharter\u002Fpdf\u002Ftext_en.pdf Articles 7 and 8 CFREU]. Here, the court reiterated that processing under [[Article 6 GDPR|Article 6(1)(c) GDPR]] must also comply with the requirements of [[Article 6 GDPR|Article 6(3) GDPR]]. Therefore, the referring court must comply with the requirements of data minimisation and [[Article 6 GDPR|Article 6(3) GDPR]] (proportionality and balancing of interests). However, the principle of data minimisation does not require the referring court to ensure that the principle of ","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-484\u002F24_-_NTH_Haustechnik&diff=51937&oldid=49547","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-06-22T14:36:54+00:00","2026-06-22T16:00:19.771429+00:00",7,[18],{"name":19,"type":20},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,31,36],{"category":28},{"id":29,"icon":23,"name":19,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":32},{"id":33,"icon":23,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":21,"icon":23,"name":24,"slug":25},[]]