Background
NTH Haustechnik GmbH, a German heating and air-conditioning company, brought civil proceedings against its former employee EM, who had also been married to the company’s managing director. Following the couple’s separation in June 2022, NTH claimed EM had sold company-owned goods on eBay for personal gain — generating approximately €13,217 in sales — and put total damages at €46,567.91. EM denied the allegations, asserting the goods were defective or outdated items NTH had given to her to dispose of.
The evidence NTH sought to deploy came from EM’s private eBay account. The Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) — the referring court — found it could not exclude that the access was unlawful. NTH’s version was that its employee (the managing director’s son) found EM’s credentials in the company computer system’s browsing history and a “family file” stored on the company server. EM’s version was that the managing director reported her company-registered mobile phone as lost, obtained a replacement SIM, and used it to reset her eBay password without her knowledge or consent.
Facing those competing accounts and uncertain how the GDPR governed the subsequent litigation use of that data, the referring court stayed proceedings and referred questions to the CJEU under Article 267 TFEU. It asked, in substance, whether Articles 5, 6, 9, 13, and 17 GDPR permit national courts — when acting in their judicial capacity — to admit and rely on personal data tendered as evidence, including data a party may have collected in breach of the GDPR, and what legal basis or legislative conditions the regulation requires for such processing.
The Court’s Holding
The Fifth Chamber interpreted the GDPR’s storage-limitation principle (Article 5(1)(e)), the lawfulness grounds for processing (Article 6(1)(e) — performance of a public-interest task), the special-category exception for legal proceedings (Article 9(2)(f)), the transparency obligations of Article 13, and — most critically — the right-to-erasure exception in Article 17(3)(e), which provides that the erasure obligation does not apply where processing is necessary for the establishment, exercise, or defence of legal claims. The court confirmed that Article 17(3)(e) is available to controllers and courts alike when personal data is used in active litigation, meaning an employer facing a damages claim cannot be compelled to delete evidence merely because the employee invokes the right to be forgotten.
On the question of unlawfully gathered evidence, the court addressed the tension between the fundamental right to personal data protection (Article 8 of the EU Charter) and the right to an effective remedy and fair trial (Article 47 of the Charter). It held that an initial breach of the GDPR in collecting data does not automatically bar that data from being used in national court proceedings; rather, the national court must conduct a proportionality assessment, weighing the severity of any data-protection violation against the legitimate interests at stake in the litigation — including the nature of the alleged misconduct, the availability of alternative evidence, and the degree of harm caused to the data subject by the unlawful collection.
On the legal-basis question, the court addressed whether broad German procedural rules — Paragraphs 138, 286, and 355 of the Code of Civil Procedure — are sufficiently clear and precise to satisfy the GDPR’s requirement that the basis for judicial processing of personal data be foreseeable in its application. The court confirmed that courts acting in their judicial capacity may rely on Article 6(1)(e) (public-interest task/exercise of official authority) as the lawfulness ground for processing evidence, and that Member State procedural law can constitute the necessary legal basis even without highly specific data-protection admissibility criteria, provided courts apply the regulation’s proportionality principles when ruling on disputed evidence.
Key Takeaways
- Article 17(3)(e) GDPR shields employers from erasure demands when the disputed personal data is being actively used in civil litigation to establish or defend a legal claim.
- Courts acting in their judicial capacity process personal data within the meaning of the GDPR; Article 6(1)(e) (public-interest task) provides the applicable lawfulness ground, and Member State procedural law can serve as the required legal basis.
- An employer’s potentially unlawful collection of employee data does not automatically render that evidence inadmissible — national courts must conduct a proportionate balancing of the data subject’s protection interests against the legitimate judicial interest in adjudicating the dispute.
- General procedural codes without explicit GDPR admissibility criteria can satisfy the regulation’s legal-basis requirements, provided the adjudicating court applies proportionality analysis when deciding whether to admit and use the data.
Why It Matters
This ruling fills a significant gap in GDPR guidance for employment litigation across the EU. It confirms that the “legal claims” exception is not confined to the party that collected the data — courts themselves can rely on it when processing evidence in their judicial capacity — and it makes clear that the right to be forgotten cannot be weaponised to suppress evidence of alleged workplace misconduct simply because the employer’s investigation methods were irregular. For in-house counsel and employment litigators, the message is that potentially tainted evidence is not automatically excluded, but that the manner of collection will be scrutinised and weighed.
At the same time, the ruling does not give employers a free pass to conduct covert surveillance or unauthorised access to employees’ private accounts. Courts must still examine the proportionality of how data was obtained, meaning that the more serious the GDPR breach in collection, the greater the risk that a national court will decline to admit the resulting evidence. Practitioners advising employers on workplace investigations should treat this decision as reinforcing the need for lawful, documented investigative procedures — not as licence to rely on whatever data can be obtained.