Opinion of the Advocate General — ECLI:EU:C:2025:803
Date: 2025-10-16
Language of the case: German

Summary C-484/24 – 1 
Case C-484/24 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
10 July 2024 
Referring court: 
Landesarbeitsgericht Niedersachsen (Germany) 
Date of the decision to refer: 
8 May 2024 
Applicant and appellant: 
NTH Haustechnik GmbH 
Defendant and respondent: 
EM 
  
Subject matter of the main proceedings 
Action under labour law for damages due to alleged misappropriation and 
unauthorised resale of company property by the defendant at second instance 
(appeal) before the referring court 
Nature and subject matter of the request for a preliminary ruling 
Interpretation of EU law; subject matter: Personal data protection 
Questions referred for a preliminary ruling 
1. 
Do the provisions of Article 92 of the Grundgesetz (Basic Law, ‘the GG’), 
Sections 138, 286, 355 et seq. of the Zivilprozessordnung (Code of Civil 
Procedure, ‘the ZPO’) in the case of an independent judicial processing activity 
falling under Article 6(1)(e), (3) of the GDPR fulfil the requirement of certainty 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-484/24 
 
2  
arising from Article 8(2), Article 52(1) of the Charter of Fundamental Rights of 
the European Union (‘the CFR’) and Article 5(1)(c) of the GDPR if the judicial 
processing activity involves interference with fundamental rights for a party or a 
third party? 
2. 
(a) 
When processing data – in particular personal data – can a national court rely on 
the fact that such processing is authorised under Article 17(3)(e) of the GDPR, or 
do Articles 6 and 9 of the GDPR constitute the exclusive basis for judicial 
processing activities? 
(b) 
If Article 17(3)(e) of the GDPR can in principle form a legal basis for judicial 
processing activities: 
(aa) 
Does this also apply to cases in which the original collection of those data by a 
litigant or a third party was not lawful? 
(bb) 
Does the processing of originally unlawfully collected data under the generally 
applicable principle of good faith (Article 5(1)(a) of the GDPR) lead to a 
restriction of judicial processing under secondary law in the sense that 
Article 17(3)(e) of the GDPR is only applicable under certain conditions or within 
certain limits? 
(cc) 
Is the provision in Article 17(3)(e) of the GDPR to be understood in such a way 
that a prohibition on the judicial utilisation of originally unlawfully obtained data 
is always excluded – i.e. the court must always utilise those data – if the original 
data collection was not covert and was used to prove an intentional breach of 
duty? 
3. 
Irrespective of whether the judicial data processing activity is subject to 
Article 17(3)(e) of the GDPR or Article 6(1)(c) or (e), (3), Article 9 of the GDPR 
or other provisions of EU law: 
(a) 
NTH HAUSTECHNIK 
 
3 
Do the principles of necessity and data minimisation under data protection law 
pursuant to Article 52(1) sentence 2 of the CFR, Article 5(1)(a) of the GDPR, in 
particular with regard to the processing of originally unlawfully collected or 
stored data, give rise to the need for a comprehensive proportionality test and 
balancing by the courts? 
(b) 
What impact does Article 5(1)(e) of the GDPR, which stipulates that personal data 
may be kept for no longer than is necessary for the purposes for which such data 
are processed, have on subsequent judicial data processing activities, in particular 
in cases where 
– the original data collection served other purposes, or  
– the original unlawful data collection took place a long time ago, or  
– unlawful storage has been maintained for longer periods of time, or 
– the unlawful data collection concerns data that were stored a long time 
ago – possibly unlawfully, or 
– the data processing or collecting body or person has undertaken, either 
unilaterally or under individual contract or collective law, to erase the 
data within a certain period of time, but has not done so? 
(c) 
Does it follow from EU law, in particular from Article 8 of the CFR, 
Article 6(1)(c) or (e), (3), Article 9 of the GDPR, that the national court can utilise 
evidence that was obtained in violation of personal rights only if there is a 
recognisable interest of the party bearing the burden of proof that goes beyond the 
simple interest in evidence, or do no requirements follow from EU law in this 
respect, such that it is up to the national legal system to make provisions in that 
regard? 
(d) 
Does it follow from Article 47(2) of the CFR, which guarantees the right to 
effective judicial protection and, in particular, to a fair trial, according to which 
the parties to civil proceedings must in principle be able sufficiently to 
substantiate and prove their legal protection objective, that the judicial processing 
of personal data of the applicant employee unlawfully collected by the employer 
can only be inappropriate and disproportionate in the narrower sense if the data 
collection under EU law would prove to be a serious infringement of Article 7 and 
Article 8 of the CFR and other possible sanctions for the employer (e.g. 
compensation for damages under Article 82 of the GDPR and the imposition of 
fines under Article 83 of the GDPR) would be completely inadequate, or can 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-484/24 
 
4  
inappropriateness and disproportionality be established even in the case of other, 
less serious breaches of data protection law during the original data collection? 
(e) 
When deciding whether to utilise the data originally collected from a party or a 
third party as part of its judicial data processing activities, does the court have to 
take into account whether the data collector has complied with its information 
obligations under Article 13 of the GDPR? If so: Under what conditions and 
according to what standards must the court take this into account? 
(f) 
Does the fact that the Court is bound by the GDPR and the Charter of 
Fundamental Rights of the European Union when processing personal data also 
include the personal data of third parties? In what way does a possible breach of 
data protection law in the original data collection have an effect on any 
subsequent judicial data processing in a dispute between two parties? Can a party 
rely on an offence committed not against it but against third parties, or is that not 
the case? 
Provisions of national law relied on 
Basic Law for the Federal Republic of Germany, issued on 23 May 1949, last 
amended by Article 1 of the Act of 19 December 2022 (Federal Law Gazette 2022 
I, No 54, p. 2478) 
Article 92 stipulates as follows: 
‘The judicial power shall be vested in the judges; it shall be exercised by the 
Federal Constitutional Court, by the federal courts provided for in this Basic Law, 
and by the courts of the Länder.’ 
Code of Civil Procedure of 30 January 1877 in the version published on 
5 December 2005 (Federal Law Gazette 2005 I, No 72, p. 3202, corrected in 
Federal Law Gazette 2006 I, No 9, p. 431, and Federal Law Gazette 2007 I, 
No 37, p 1781), last amended by the Act of 22 December 2023 (Federal Law 
Gazette 2023 I, No 411) 
Section 138 stipulates as follows: 
‘(1) The parties are to make their declarations as to the facts and circumstances 
fully and completely and are obligated to tell the truth. 
(2) Each party is to react in substance to the facts alleged by the opponent. 
NTH HAUSTECHNIK 
 
5 
(3) Facts that are not expressly disputed are to be deemed as having been 
acknowledged unless the intention to dispute them is evident from the other 
declarations made by the party. 
(4) A party may declare its lack of knowledge only where this concerns facts 
that were neither actions taken by the party itself, nor within its ken.’ 
Section 286 reads as follows: 
‘(1) The court is to decide, at its discretion and conviction, and taking account of 
the entire content of the hearings and the results obtained by evidence being taken, 
if any, whether an allegation as to fact is to be deemed true or untrue. The 
judgment is to set out the reasons informing the conviction of the judges. 
(2) The court shall be bound to statutory rules of evidence only in the cases 
designated in the present Code.’ 
Bundesdatenschutzgesetz (Federal Data Protection Act, ‘the BDSG’) of 30 June 
2017 (Federal Law Gazette 2017 I, No 44, p. 2097), last amended by Article 7 of 
the Act of 6 May 2024 (Federal Law Gazette 2024 I, No 149), Section 3 
(Processing of personal data by public bodies) and Section 26 (Data processing for 
the purposes of the employment relationship) 
Provisions of European Union law relied on 
Charter of Fundamental Rights of the European Union of 12 December 2007 (‘the 
CFR’), Articles 7, 8, 47, 52 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation, ‘the GDPR’), Articles 5, 6, 9, 13, 
17 
Succinct presentation of the facts and procedure and the essential arguments 
of the parties 
1 The applicant, as employer, is claiming damages from the defendant employee for 
the alleged misappropriation and unauthorised resale of company property. The 
defendant is married to the managing director of the applicant; the couple are now 
separated. The employment relationship between the applicant and the defendant, 
who worked there as an office employee, has ended.  
2 Immediately after the couple’s separation, the applicant discovered that the 
defendant had sold equipment belonging to the applicant on her own account via 
the sales platform eBay on a total of 195 occasions. According to the applicant, 
the total amount of damages is in the five-digit range. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-484/24 
 
6  
3 The applicant became aware of the defendant’s sales transactions through 
computerised access to the defendant’s private eBay account. For that purpose, the 
applicant’s employee used the defendant’s user ID and password. The way in 
which the applicant’s employee gained knowledge of those details is disputed. 
While the applicant claims to have gained knowledge about the use of the eBay 
site by the defendant by inspecting the browser history of the applicant’s company 
computer used by the defendant and knowledge of the password by inspecting a 
‘family folder’ created on the applicant’s server, where the password was stored, 
the defendant claims not to have stored her user password on company data 
storage devices. She assumes that the applicant reported the loss of the mobile 
phone registered to the applicant and used by the defendant, then requested a new 
SIM card with a new PIN from the telephone provider and then used this 
telephone number to change the password of the defendant’s private account on 
the eBay platform and then to gain access to the account. 
Succinct presentation of the reasoning in the request for the preliminary 
ruling 
4 As regards the first question referred, the Court pointed out in its judgments of 
24 March 2022 – C-245/20 – (Autoriteit Persoonsgegevens) in paragraph 25 and 
of 2 March 2023 – C-268/21 – (Norra Stockholm Bygg AB) in paragraph 26 that 
the GDPR applies, inter alia, to processing operations carried out by public 
authorities, including judicial authorities such as courts. 
5 Article 8(2), sentence 1 of the CFR lays down that such data must be processed 
fairly for specified purposes and on the basis of the consent of the person 
concerned or some other legitimate basis laid down by law. According to 
Article 6(3), sentence 1 of the GDPR, the legal basis for the processing operations 
pursuant to Article 6(1)(c) and (e) – in so far as EU law does not contain any 
provisions – is determined by the law of the Member States to which the 
controller is subject. Article 6(3), sentence 2 of the GDPR stipulates that the 
purpose of the processing must be defined in that legal basis. However, with 
regard to the processing pursuant to Article 6(1)(e), introduced by the word ‘or’, it 
also states that this must be necessary for the performance of a task carried out in 
the public interest or in the exercise of official authority vested in the controller. 
6 In that context, it should also be borne in mind that, in its judgment of 24 February 
2022 – C-175/20 – Valsts ienëmumu dienests, paragraph 83, the Court stated, in 
the context of a right of access by public authorities, that, in order to satisfy the 
requirement of proportionality expressed in Article 5(1)(c) of Regulation 
2016/679, the regulation on which the processing is based must provide clear and 
precise rules on the scope and application of the measure in question and lay down 
minimum requirements. That legislation must be legally binding under domestic 
law and, in particular, must indicate in what circumstances and under which 
conditions a measure providing for the processing of such data may be adopted, 
thereby ensuring that the interference is limited to what is strictly necessary. 
NTH HAUSTECHNIK 
 
7 
7 Against that background, the referring court asks whether the second sentence of 
Article 6(3) of the GDPR must be interpreted as meaning that, in the case of 
judicial activities involving interference with fundamental rights and the 
associated data processing, it is sufficient that the processing is necessary for the 
performance of a task carried out in the public interest or in the exercise of 
delegated official authority, or whether the interpretation of the provision rather 
shows that further – higher – requirements of certainty must be placed on the legal 
basis of the judicial processing. 
8 Should the Court come to the conclusion that legal provisions are also required for 
judicial processing activities involving interference with fundamental rights, 
which in particular contain information on the circumstances and conditions under 
which data provided by the parties may be utilised by the court, the referring court 
further asks whether the national provisions – in this case in particular Article 92 
of the GG, Section 3 of the BDSG and Sections 138, 286, 355 et seq. of the ZPO – 
fulfil these requirements in the opinion of the Court. By way of explanation, it 
should be noted that neither the German Federal Data Protection Act nor the 
German Code of Civil Procedure contain provisions on which requirements must 
be met or which criteria must be weighed against each other in order to determine 
whether a court must, can or may take into account the submissions of a party or 
take the evidence offered by a party into account. In particular, there are no 
provisions for instances where the party has unlawfully obtained the knowledge 
on which its submissions are based or refers to unlawfully obtained evidence. In 
German civil proceedings, prohibitions on utilisation are applied solely on the 
basis of judicial law. 
9 As regards the second question referred, the referring court points out that the 
Bundesarbeitsgericht (Federal Labour Court of Germany) has stated that the 
processing of personal data by the court – possibly for a different purpose – may 
be considered even if the pre- or extra-judicial collection of such data by a party to 
the proceedings is unlawful under the GDPR or national data protection law. This 
follows in all clarity (acte clair) from Article 17 of the GDPR. However, in its 
decision of 24 September 2019 – C-136/17 – (GC and Others), the Court clarified 
in paragraph 57 that the right to the protection of personal data is not an 
unrestricted right, but must be seen in the light of its social function and weighed 
against other fundamental rights in accordance with the principle of 
proportionality. 
10 In contrast, the referring court points out that Article 17 of the GDPR only 
contains provisions on a right to erasure and therefore, in its view, cannot be used 
as a basis for judicial processing activities. It also appears questionable whether 
the content of Article 17(3)(e), according to which the erasure rights or 
obligations do not apply if the processing is necessary for the establishment, 
exercise or defence of legal claims, is applicable to judicial activity. The referring 
court is not able to recognise an acte clair, which is why it asks for clarification as 
to whether it is correct that Article 6(1)(e) and Article 9(2)(f) of the GDPR form 
the relevant legal basis under data protection law for the courts’ activities and 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-484/24 
 
8  
whether the courts can also rely on Article 17(3)(e) of the GDPR as the legal basis 
for their own judicial processing activities. 
11 If the Court considers that Article 17(3)(e) of the GDPR is capable of providing 
such a basis for judicial processing, the referring court wishes to know whether 
and, if so, under what conditions and within what limits that provision applies 
where the initial collection of data was not lawful. 
12 With regard to question 3(a), the referring court asks whether, in the case of data 
initially collected or stored unlawfully, the courts may carry out processing only 
after a comprehensive proportionality test and balancing exercise and whether, in 
cases where a party introduces unlawfully obtained data into the proceedings, it 
makes a difference if the authenticity and accuracy of the data as such is not 
disputed by the other party. 
13 With regard to question 3(b), the application of Article 5(1)(e) of the GDPR raises 
the question of what influence it has on the subsequent judicial processing activity 
if the original data collection or storage served purposes other than those now 
pursued by the party and may have been carried out a long time ago or maintained 
over a long period of time, as well as the question of whether such criteria should 
be included in the proportionality test and balancing and how to proceed if 
contractual erasure obligations existed that have not been fulfilled. 
14 With regard to question 3(c), the referring court states that, in the case of data 
collection involving an interference with the general right of personality of the 
person concerned, the Bundesverfassungsgericht (Federal Constitutional Court of 
Germany) has consistently held that, despite the interference with personality, the 
interest in the collection of evidence must require protection, for example in the 
form of a situation of self-defence or a situation similar to self-defence. The 
referring court asks whether the Court also derives such a legal principle from EU 
law in the same or a similar way or whether it is for the national legal system to 
lay down rules in that regard. 
15 With regard to question 3(d), the referring court asks whether, on the basis of the 
right to effective judicial protection guaranteed by Article 47(2) of the CFR and, 
in particular, to a fair trial, it may not utilise the employee’s personal data, which 
may have been unlawfully collected by the employer, only if the collection of the 
data proves to be a serious breach of Article 7 and Article 8 of the CFR, or 
whether other, less serious breaches of data protection law in the original data 
collection could also lead to judicial utilisation being inappropriate and 
disproportionate. 
16 With regard to question 3(e), the referring court wishes to know whether and 
according to what specific standards a possible breach of the information 
obligations under Article 13 of the GDPR has an impact on the court’s decision as 
to whether it can utilise the data originally collected. 
NTH HAUSTECHNIK 
 
9 
17 Finally, with regard to question 3(f), the referring court asks whether the Court 
can make observations and lay down standards that go beyond those set out in its 
decision of 2 March 2023 – C-268/21 – paragraph 55 on the role of the protection 
of the personal data of third parties in the judicial use of the data introduced by a 
party to the proceedings.