Provisional text
OPINION OF ADVOCATE GENERAL
SPIELMANN
delivered on 16 October 2025 (1)
Case C‑484/24
NTH Haustechnik GmbH
v
EM
(Request for a preliminary ruling from the Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony, Germany))
( Reference for a preliminary ruling – Data protection – Lawfulness of the processing of data in judicial proceedings concerning employment – Data collected by the employer in order to prove a serious failure by the employee to comply with her obligations – Processing of unlawfully obtained evidence – Principle of storage limitation – Procedural autonomy of the Member States )
Introduction
1.        The question referred for a preliminary ruling which is the subject of this targeted Opinion, in accordance with the Court’s request, concerns the interpretation of Article 5(1)(e) of Regulation (EU) 2016/679. (2) The Court is asked, in essence, to consider the question of whether and to what extent personal data produced as evidence in national judicial proceedings, which were obtained by recourse to other personal data initially collected or retained in breach of the principle of storage limitation, may be lawfully processed by the national court.
2.        The request for a preliminary ruling has been made by the Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony, Germany) in proceedings between NTH Haustechnik GmbH (‘NTH’) and its former employee
(‘the defendant’)
concerning an action for damages in order to obtain compensation for the damage suffered as a result of the unauthorised online sale, by the defendant,
of goods belonging to NTH.
Legal framework
European Union law
3.        Article 5
of the GDPR, entitled ‘Principles relating to processing of personal data’, provides, in paragraph 1 thereof:
‘1.      Personal data shall be:
(a)      processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
…
(e)      kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods in so far as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (“storage limitation”);
…’
4.        Article 6 of the GDPR, entitled ‘Lawfulness of processing’, states that:
‘1.      Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(e)      processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
….
2.      Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
3.      The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
(a)      Union law; or
(b)      Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
…’
5.        Article 23 of the GDPR, entitled ‘Restrictions’, provides:
‘1.      Union or Member
State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
…
(j)      the enforcement of civil law claims.
…’
German law
The Code of Civil Procedure
6.        Paragraph 138 of the Zivilprozessordnung (Code of Civil Procedure; ‘the ZPO’) of 30 January 1877, (3) entitled ‘Obligation to make declarations as to facts; obligation to tell the truth’, provides, in the version applicable to the dispute in the main proceedings:
‘(1)      The parties shall make their declarations as to the facts and circumstances fully and completely and are obligated to tell the truth.
(2)      Each party shall react in substance to the facts alleged by the opponent.
(3)      Facts that are not expressly disputed shall be deemed as having been agreed unless the intention to dispute them is evident from the other declarations made by the party.
(4)      A party may declare its lack of knowledge only where this concerns facts that were neither actions taken by the party itself, nor have been perceived by the party’.
Federal Law on data protection
7.        Paragraph 3 of the Bundesdatenschutzgesetz
(Federal Law on data protection)
of 30 June
2017, (4) entitled ‘Processing of personal data by public bodies’, in the version applicable to the dispute in the main proceedings, states:
‘Public bodies shall be permitted to process personal data if such processing is necessary to perform the task for which the controller is responsible or to exercise official authority which has been vested in the controller’.
The dispute in the main proceedings, the questions referred for a preliminary ruling and the proceedings before the Court
8.        NTH is a company which operates a heating and air-conditioning business. The defendant was an employee of the company and was married to its managing director. The son of the defendant and the managing director of NTH is also an employee of that company.
9.        The employment relationship between NTH and the defendant ended on 31 October 2019 and the couple separated on 26 June 2022. However, until the separation, the defendant was still able to access the company’s premises and use the computers located there. The question whether she did so only for private purposes or whether she continued to carry out activities for NTH is in dispute.
10.      Immediately after the couple’s separation, NTH discovered that the defendant had personally sold equipment belonging to the company via the sales platform eBay, and is seeking damages from her on that basis.
11.      The referring court states that NTH became aware of the defendant’s sales transactions through computerised access to the defendant’s private eBay account. In order to do that, the son of the defendant and the managing director of NTH used the defendant’s eBay user ID and password. The way in which NTH became aware of those details is disputed.
12.      In that regard, NTH claims to have become aware
of the defendant’s use of the eBay online platform by inspecting the browser history of the company computer used by the defendant and obtained the password by inspecting a ‘family folder’ created on NTH’s server, where the password was registered. By contrast, the defendant claims not to have stored her eBay user password on company data storage devices and contends that NTH used the mobile phone, which was registered to the company but used by the defendant, to change the password of the defendant’s private account on the eBay platform and then to gain access to the account.
13.      The referring court is of the view that the collection and storage of data by NTH, through which it became aware of the defendant’s sales on the eBay online platform, may have been carried out unlawfully. It also considers that its own judicial activity and, if required, use of the data collected by NTH in reaching its decision, constitute data processing within the meaning of the GPDR. In that regard, the referring court asks, in essence, about the conditions that must be laid down by national legislation for judicial data processing activity and the legal bases and substantive criteria which must govern such activity.
14.      In those circumstances, the Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) decided to stay the proceedings before it and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1)      Do the provisions of Article 92 of the Grundgesetz (Basic Law[;]
“the GG”), Paragraphs 138, 286, 355 et seq. of the Zivilprozessordnung (Code of Civil Procedure[;]
“the ZPO”) in the case of an independent judicial processing activity falling under Article 6(1)(e) [and] (3) of the GDPR fulfil the requirement of certainty arising from Article 8(2), Article 52(1) of the Charter of Fundamental Rights of the European Union [(5)] and Article 5(1)(c) of the GDPR if the judicial processing activity involves interference with fundamental rights for a party or a third party?
(2)(a)      When processing data – in particular personal data – can a national court rely on the fact that such processing is authorised under Article 17(3)(e) of the GDPR, or do Articles 6 and 9 of the GDPR constitute the exclusive basis for judicial processing activities?
(b)      If Article 17(3)(e) of the GDPR can in principle form a legal basis for judicial processing activities:
(aa)      Does this also apply to cases in which the original collection of those data by a litigant or a third party was not lawful?
(bb)      Does the processing of originally unlawfully collected data under the generally applicable principle of good faith (Article 5(1)(a) of the GDPR) lead to a restriction of judicial processing under secondary law in the sense that Article 17(3)(e) of the GDPR is only applicable under certain conditions or within certain limits?
(cc)      Is the provision in Article 17(3)(e) of the GDPR to be understood in such a way that a prohibition on the judicial utilisation of originally unlawfully obtained data is always excluded – i.e. the court must always utilise those data – if the original data collection was not covert and was used to prove an intentional breach of duty?
(3)      Irrespective of whether the judicial data processing activity is subject to Article 17(3)(e) of the GDPR or Article 6(1)(c) or (e), (3), Article 9 of the GDPR or other provisions of EU law:
(a)      Do the principles of necessity and data minimisation under data protection law pursuant to Article 52(1) sentence 2 of [the Charter],
Article 5(1)(a) of the GDPR, in particular with regard to the processing of originally unlawfully collected or stored data, give rise to the need for a comprehensive proportionality test and balancing by the courts?
(b)      What impact does Article 5(1)(e) of the GDPR, which stipulates that personal data may be kept for no longer than is necessary for the purposes for which such data are processed, have on subsequent judicial data processing activities, in particular in cases where
–        the original data collection served other purposes, or
–        the original unlawful data collection took place a long time ago, or
–        unlawful storage has been maintained for longer periods of time, or
–        the unlawful data collection concerns data that were stored a long time ago – possibly unlawfully, or
–        the data processing or collecting body or person has undertaken, either unilaterally or under individual contract or collective law, to erase the data within a certain period of time, but has not done so?
(c)      Does it follow from EU law, in particular from Article 8 of [the Charter], Article 6(1)(c) or (e), (3), Article 9 of the GDPR, that the national court can utilise evidence that was obtained in violation of personal rights only if there is a recognisable interest of the party bearing the burden of proof that goes beyond the simple interest in evidence, or do no requirements follow from EU law in this respect, such that it is up to the national legal system to make provisions in that regard?
(d)      Does it follow from Article 47(2) of [the Charter], which guarantees the right to effective judicial protection and, in particular, to a fair trial, according to which the parties to civil proceedings must in principle be able sufficiently to substantiate and prove their legal protection objective, that the judicial processing of personal data of the applicant employee unlawfully collected by the employer can only be inappropriate and disproportionate in the narrower sense if the data collection under EU law would prove to be a serious infringement of [Articles 7 and 8] of [the Charter] and other possible sanctions for the employer (e.g. compensation for damages under Article 82 of the GDPR and the imposition of fines under Article 83 of the GDPR) would be completely inadequate, or can inappropriateness and disproportionality be established even in the case of other, less serious breaches of data protection law during the original data collection?
(e)      When deciding whether to utilise the data originally collected from a party or a third party as part of its judicial data processing activities, does the court have to take into account whether the data collector has complied with its information obligations under Article 13 of the GDPR? If so: Under what conditions and according to what standards must the court take this into account?
(f)      Does the fact that the Court is bound by the GDPR and [the Charter] when processing personal data also include the personal data of third parties? In what way does a possible breach of data protection law in the original data collection have an effect on any subsequent judicial data processing in a dispute between two parties? Can a party rely on an offence committed not against it but against third parties, or is that not the case?’
15.      Written observations were submitted by the European Commission and the German, Hungarian and Finnish Governments. The Commission and the German Government presented oral argument at the hearing on 2 July 2025.
Analysis
Preliminary remarks
16.      By part (b) of the third question for a preliminary ruling which is the subject of this targeted Opinion, the referring court asks, in essence, what impact data processing activities contrary to the principle of storage limitation laid down in Article 5(1)(e) of the GPDR have on the lawfulness of ‘subsequent processing activities’, (6) in the course of its judicial activity, concerning other data which could be obtained only by recourse to those initial data.
17.      For an understanding of the case, I think it useful to point out that a distinction should be drawn between two types of personal data at issue in the present case. On the one hand, the data relating to the defendant stored on NTH’s server and in the browser history of the company computer used by the defendant, or in the company’s telephone made available to the defendant, enabled NTH to retrieve the defendant’s eBay password and user ID in order to access her private account on the eBay online sales platform. For the sake of convenience in the present Opinion, I shall use the term ‘initial data’ when referring to those data. On the other hand, the data relating to the sales of equipment belonging to the company, which were extracted from the eBay website and used as a basis for the action brought by NTH against the defendant, will be referred to as ‘data relating to the sales’.
18.      First, as regards the initial data, the referring court stated that the way in which the son of the defendant and the managing director of NTH became aware of the defendant’s eBay password and user ID is disputed. Nonetheless, in part (b) of the third question for a preliminary ruling, the referring court appears to be working on the assumption that
those data were collected and stored in breach of the principle of storage limitation, laid down in Article 5(1)(e) of the GDPR, according to which personal data must be kept ‘for no longer than is necessary for the purposes for which the personal data are processed’.
19.      In that regard, the referring court refers to the fact that ‘the initial data collection served other purposes’. It also mentions unlawful collection which ‘took place a long time ago’, unlawful storage which ‘dates back a long time’ or continued
‘for long periods of time’, and failure to fulfil a contractual obligation to erase the data collected ‘within a certain period of time’. I understand that to imply that the collection of the initial data had purposes other than to enable the company subsequently to collect other data, namely the data relating to the sales, in order to bring an action against the defendant, and that the storage period of the initial data exceeded the period of time needed to fulfil the purposes for which those data were initially collected and stored. (7)
20.      Second, in my view, it is not possible to regard the data relating to sales as
fitting into the situations of (i) an initial collection which served ‘other purposes’ or (ii) storage which took place a long time ago, and continued for long periods of time or which failed to fulfil a contractual obligation to erase the data. It is not apparent from the information in the file that
those data were stored by NTH for a long period of time or that their collection by NTH served a purpose other than the bringing of an action against the defendant. There is also no need to examine a hypothetical unlawful collection or storage of online sales data held on eBay.
21.      Despite that, it follows, in my view, from the order for reference that the referring court assumes that, in so far as NTH actually breached the principle laid down in Article 5(1)(e) of the GDPR in respect of the initial data, the subsequent use of those data to access the defendant’s private eBay account is vitiated by unlawfulness as is also, in consequence, the collection by NTH of the data relating to the sales. (8)
22.      The interest of the present case therefore lies in the lawfulness of the referring court’s processing of the data relating to the sales in the course of its judicial activity, since the GDPR applies to all processing operations carried out by judicial authorities such as the referring court. (9) It follows that account should be taken, in the answer to be provided to that court, of the conditions for the lawfulness of the processing of personal data laid down in Article 6 of the GDPR.
23.      Accordingly, for the purposes of the present case, I would suggest that the Court reformulate part (b) of the third question referred so that the Court assesses whether Article 5(1)(e) of the GDPR, read in conjunction with Article 6 of that regulation, must be interpreted as meaning that the principle of ‘storage limitation’ laid down in that provision precludes a national court from processing, in its judicial capacity, data which were obtained by recourse to other data which were initially collected or stored in breach of that principle or imposes on the national court specific requirements as to how that personal data are to be used.
Part (b) of the third question
24.      I would point out that any processing of personal data, including processing carried out by public authorities such as courts, must observe the principles governing the processing of personal data and the rights of the person concerned set out, respectively, in Chapters
II and
III of the GDPR. In particular, such processing must comply with the principles set out in Article 5 of that regulation and, in the light of the principle of the lawfulness of processing laid down in paragraph 1(a) of that article, satisfy the conditions of lawfulness listed in Article 6 of that regulation. (10) The latter provision sets out, in paragraph 1 thereof, an exhaustive and restrictive list of the cases in which processing of personal data may be regarded as lawful. In order to be capable of being regarded as such, processing must fall within one of the cases provided for in that provision. (11)
25.      In particular, the processing of personal data at issue in the main proceedings, namely their use by the referring court in the judicial process, may fall within Article 6(1)(e) of the GDPR, under which the processing is lawful if and to the extent that
it is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’, which provision, moreover, corresponds to Paragraph 3 of the Federal Law on data protection. (12)
26.      As stated in points 16 to 22 of the present Opinion, the question arises in the main proceedings as to the impact that a number of breaches by NTH of the principle of storage limitation laid down in Article 5(1)(e) of the GDPR in respect of the initial data have on the admissibility and use of the data relating to the sales by the referring court in the course of its judicial activity.
27.      In that regard, I recall that, in accordance with settled case-law,
the interpretation of a provision of EU law requires account to be taken not only of its wording, but also of its context, and the objectives and purpose pursued by the act of which it forms part. (13)
28.      As regards Article 5(1)(e) of the GDPR, the Court has previously stated that it is unequivocally clear from the wording of that article that the principle of ‘storage limitation’ requires the controller to be able to demonstrate that personal data are kept only for as long as is necessary for the purposes for which they were collected or for which they have been further processed. Therefore, even initially lawful processing of data may over time become incompatible with the GDPR where those data are no longer necessary for such purposes. (14)
29.      From a contextual viewpoint, Article 5(1)(e) of the GDPR establishes one of the principles relating to data processing laid down in Article 5 of that regulation and gives expression to the principle of proportionality. It means assessing the proportionality of the treatment in relation to its purpose, in the light of the time that has passed. Thus, recital 39 of the GDPR explicitly states that the period for which data are stored must be ‘limited to a strict minimum’ and that ‘in order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review’. (15)
30.      The objective pursued by Article 5(1)(e) of the GDPR, as is clear from recital 10 of that regulation, is that of ensuring a high level of protection of individuals within the European Union with respect to the processing of their personal data. (16)
31.      Therefore, Article 5(1)(e) of the GDPR relates only to the requirements governing the storage of personal data (17) and does not therefore make it possible to provide a detailed answer to the question of the impact of a breach, by a first controller, of the principle of storage limitation of personal data on the processing of personal data by a national court in the course of its judicial activity. Moreover, no such answer seems, in my view, to be apparent from any other provision of that regulation.
32.      Neither Article 5(1)(e) of the GDPR nor Article 6(1)(e) of that regulation lays down a general and absolute prohibition preventing a public authority, such as a court, from being empowered to take into account data obtained by one of the parties to the dispute by recourse to other personal data which that party processed contrary to the principle of storage limitation.
33.      In the absence of EU rules on the matter, it is for the national legal order of each Member State, in accordance with the principle of procedural autonomy of the Member States, to establish procedural rules for actions intended to safeguard the rights that individuals derive from EU law, provided, however, that those rules are no less favourable than the rules governing similar situations subject to domestic law (the principle of equivalence) and do not render impossible in practice or excessively difficult the exercise of rights conferred by EU law (the principle of effectiveness). (18) Member States must also use their discretion under the conditions and within the limits provided for by the GDPR and legislate in such a way as not to undermine the content and objectives thereof. (19)
34.      More specifically, according to Article 6(3) of the GDPR, read in conjunction with recitals 10, (20) 20 (21) and 45 (22) of that regulation, the legal basis for the processing referred to in Article 6(1)(e) of that regulation,
to be defined, as the case may be, by EU or Member State law to which the controller is subject, must meet an objective of public interest and be proportionate to the legitimate aim pursued. That legal basis may also contain specific provisions to adapt the application of the rules of the GDPR, such as, inter alia, general conditions governing the lawfulness of processing by the controller or processing operations and processing procedures, including measures to ensure lawful and fair processing, such as those provided for in other specific processing situations, referred to in Chapter IX of the GDPR. (23) Member States therefore have the power to maintain or introduce national measures to further specify the application of the rules of that regulation, as provided for in Article 6(2) of that regulation.
35.      Moreover, the GDPR provides that Member States may derogate, inter alia, from Article 5 of that regulation, when necessary to safeguard certain important objectives of general public interest
including – for present purposes – ‘the enforcement of civil law claims’. Article 23(1)(j) (24) of the GDPR
states that EU and Member State law may restrict by way of legislative measures the scope of the obligations and rights provided for in that regulation, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard certain important objectives of general public interest such as that referred to above. (25)
36.      Lastly, it should be noted that the fundamental rights to respect for private life and to the protection of personal data are not absolute rights, as stated in recital 4 of the GDPR, but must be considered in relation to their function in society and be balanced against other fundamental rights, such as the right to effective judicial protection, guaranteed in Article 47 of the Charter. (26)
37.      Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must state in what circumstances and under what conditions a measure providing for the processing of such data may be taken, thereby ensuring that the interference is limited to what is strictly necessary. The legislation which entails the interference must also lay down clear and precise rules governing the scope and application of the measure in question, (27) and impose minimum safeguards, so that the persons whose personal data are affected have sufficient guarantees that those data will be effectively protected against the risk of abuse. (28)
38.      I should add that EU law does not govern the matter of the admissibility
of the evidence in national judicial proceedings which, in accordance with the principle of the procedural autonomy of the Member States, is a matter for national law, subject to observance of, inter alia, the principles of equivalence and effectiveness, as stated in point 33 of the present Opinion. (29) Nor does the European Court of Human Rights (30) consider that its role is to determine the admissibility of unlawfully obtained evidence, which is primarily a matter for national law. It is clear, in essence, from the case-law of the European Court of Human Rights
on Article 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms, (31) that the jurisdiction of that court
concerns the question whether the proceedings as a whole, including the way in which the evidence was obtained, are fair. That involves an examination of the ‘unlawfulness’ in question and, where violation of another convention right is concerned, the nature of the violation found. (32)
39.      Similarly, the Court has previously held that it is, in principle, for national law alone to determine the rules relating to the admissibility and assessment, in criminal proceedings against persons suspected of having committed serious criminal offences, of information and evidence obtained by retention of data contrary to EU law. The national rules on the admissibility, exclusion and use of evidence
containing personal data must also then observe the adversarial principle and the right to a fair hearing. (33) It cannot be otherwise in civil proceedings.
40.      It follows from the foregoing that, in the absence of EU rules on the matter, questions of admissibility and rules on use of personal data by a national court in the course of its judicial activity, including where those data are indirectly vitiated by processing contrary to the principle of limitation of the storage of other personal data used to obtain them, must have their legal basis in the law of the Member State to which the controller is subject, within the meaning of Article 6(3)(b) of the GDPR, read in conjunction with Article 23(1) of that regulation.
41.      It is clear from the information in the file that one of the legal bases for the production of data relating to the sales of equipment belonging to the company as evidence in a court action is Paragraph 138 of the Code of Civil Procedure, which imposes on the parties to the dispute the obligation to explain the facts. Paragraph 3 of the Federal Law on data protection provides for the possibility for a public body of processing personal data necessary to perform the task for which it is responsible. (34)
42.      The referring court also stated that neither the Federal Law on data protection nor the German Code of Civil Procedure contains provisions on which conditions must be satisfied or which criteria must be weighed against each other in order to determine whether a court must, can or may take into account the submissions of a party or take the evidence offered by a party into account. In particular, there are no provisions for instances where the party has unlawfully obtained the information on which its submissions are based or relies on unlawfully obtained evidence. In German civil proceedings, including before the labour court, prohibitions on utilisation of data are applied solely on the basis of judge-made
law.
43.      It is also clear from the request for a preliminary ruling that, first, according to the settled case-law of the Bundesverfassungsgericht (Federal Constitutional Court, Germany), national courts are, in principle, required, in order to establish the truth, to take the evidence offered by the parties into account, if and in so far as any allegation as to fact is relevant and must be proved in so far as it is disputed. (35)
44.      Second, the Bundesarbeitsgericht (Federal Labour Court, Germany) has, in essence, held that the processing of personal data by a court may be considered even if the pre- or extra-judicial collection of such data by a party to the proceedings is unlawful under the GDPR or national data protection law. However, if the party’s data collection involves an interference with the general personality right of the person concerned, the reliance by the party on the general interest of the evidence would not be sufficient. A national court would then have to take into account other evidence, from which it follows that the interest in obtaining evidence requires protection despite the interference with personality. (36)
45.      I conclude from this that there is a national legal basis laying down the conditions
for the admissibility and use of personal data in a situation such as that at issue in the main proceedings.
46.      The Court has previously stated that
it is irrelevant that the processing of personal data is based on a provision of substantive or procedural national law. (37) t added that ‘Member State law to which the controller is subject’, within the meaning of Article 6(3)(b) of the
GDPR, or the reference to a ‘legislative measure’, in Article 23 of that regulation, does not necessarily require a legislative act adopted by a parliament but also covers national case-law, in so far as it is clear and precise and its application is foreseeable to persons subject to it, in accordance with the case-law of the Court and of the European Court of Human Rights. (38)
47.      It is therefore for the referring court to identify the relevant provisions of national law and the case-law of the Member State concerned, to apply them and to verify whether, first, they are compatible with the principles of equivalence and effectiveness and meet an objective of public interest and, second, they are necessary and proportionate to that objective, so that they are capable of falling within the scope of cases of personal data processing regarded as lawful under the provisions of Article 6(3)(b) of the GDPR, read in combination with Article 23(1) thereof. (39)
48.      Accordingly, it is for the referring court, which alone has jurisdiction to interpret national law and national case-law, to determine the admissibility of the evidence, including personal data, and the rules governing its use, which will depend on the circumstances of the case and the type of proceedings in question.
Conclusion
49.      In the light of the foregoing considerations, I propose that the Court should answer part (b) of the third question referred by the Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony, Germany) for a preliminary ruling .as follows:
Article 5(1)(e) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), read in conjunction with Article 6 of that regulation,
must be interpreted as meaning that
the principle of ‘storage limitation’, laid down in that provision, does not preclude a national court from processing, in its judicial capacity, data which was obtained by recourse to other data which was initially collected or stored in breach of that principle.
It is for the national court to ensure that the rules governing use of those personal data in the course of its judicial activity are founded in the applicable national law, are compatible with the principles of equivalence and effectiveness, meet an objective of public interest and are necessary and proportionate to that objective.
1      Original language: French.
2      Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
3      BGBl. 2005 I, p. 3202.
4      BGBl. 2017 IS., p. 2097.
5      ‘The Charter’.
6      I consider that by ‘subsequent processing activities’ in the context of judicial activity, the referring court is referring both to the admissibility of personal data produced as evidence in the dispute and to their use in the proceedings as a basis for its decision.
7      However, I have my doubts as to the long periods of time or the long time ago
mentioned by the referring court. It is clear from the information in the file that the question whether between the end of the employment relationship between NTH and the defendant on 31 October 2019 and the couple’s separation on 26 June 2022, the defendant continued to access the company’s premises and use its computers located there for business or solely private purposes is disputed. While it is ultimately for the referring court to rule in that regard, in the context of the present Opinion and in the light of the wording of part (b) of the third question for a preliminary ruling, I shall assume that the initial data were collected and stored in breach of the principle of storage limitation.
8      In that regard, I note that, as Advocate General Ćapeta states in her Opinion in Norra Stockholm Bygg (C‑268/21, EU:C:2022:755, point 20), it may be considered that, in so far as a first processing of personal data were to be found unlawful under the GDPR, the subsequent processing of such data would, by extension, be unlawful as well.
9      See, to that effect, judgment of 24 March 2022, Autoriteit Persoonsgegevens (C‑245/20, EU:C:2022:216, paragraphs 25 and 34).
10      See judgments of 20 October 2022, Digi (C‑77/21, EU:C:2022:805, ‘the judgment in Digi’, paragraph 49 and the case-law cited); of 2 March 2023, Norra Stockholm Bygg (C‑268/21, EU:C:2023:145, ‘the judgment in
Norra Stockholm Bygg’, paragraph 29);
and of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox) (C‑60/22, EU:C:2023:373, paragraph 57 and the case-law cited).
11      See judgment of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, (C‑621/22, EU:C:2024:858, paragraph 29 and the case-law cited).
12      I note that, although the Finnish Government maintains
that the
judicial processing activities carried out in the course of judicial activity
constitute processing
falling within Article 6(1)(e) of the GDPR, and although the referring court mentions that provision in the request for a preliminary ruling, it is not apparent from the information in the file that the data processing at issue in the main proceedings is necessary
for the fulfilment of a legal obligation to which that court is subject.
13      See the judgment in Digi (paragraph 23 and the case-law cited).
14      See the judgment in Digi (paragraphs 53 and 54).
15      See Opinion of Advocate General Pikamäe in
Digi (C‑77/21, EU:C:2022:248, points 29, 30, 62 and 64).
16      See judgment of 7 May 2009, Rijkeboer (C‑553/07, EU:C:2009:293, paragraphs 33 and 35), which concerned Article 6(1)(e) of Directive 95/46/EC
of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), the corresponding provision of which is reproduced in
Article 5(1)(e) of the
GDPR; see, also, the judgment in Digi (paragraph 59).
17      See judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA (C‑708/18, EU:C:2019:1064, paragraph 29).
18      See, by analogy, judgment of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications) (C‑746/18, EU:C:2021:152,
paragraph 42).
19      See judgment of 3 April 2025, Ministerstvo zdravotnictví (Data concerning the representative of a legal person) (C‑710/23, EU:C:2025:231, paragraph 40).
20      ‘…
Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member
States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation. …’
21      ‘While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the processing operations and processing procedures in relation to the processing of personal data by courts and other judicial authorities. …’
22      ‘Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law. …’
23      See judgments in
Norra Stockholm Bygg (paragraph 32), and of 3 April 2025, Ministerstvo zdravotnictví (Data concerning the representative of a legal person) (C‑710/23, EU:C:2025:231, paragraph 37).
24      The German Government adds that the processing of personal data by the referring court
may also fall within the objective of
protection of judicial independence and judicial proceedings
laid down in Article 23(1)(f) of the
GDPR.
25      See, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes) (C‑175/20, ‘the judgment in
Valsts ieņēmumu dienests’, EU:C:2022:124, paragraph 51); Opinion of Advocate General Pikamäe in I. (Sale of a database) (C‑693/22, EU:C:2024:162, points 85
to 88).
26      See the judgment in
Norra Stockholm Bygg (paragraph 49). The more specific question of balancing the right to protection of personal data
against the right to effective judicial protection
falls within part (d) of the third question for a preliminary ruling,
which is not the subject of this targeted Opinion.
27      See, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraph 105 and the case-law cited).
28      See, to that effect, the judgment in Valsts ieņēmumu dienests (paragraph 83 and the case-law cited), which concerned, inter alia, compliance with the principle of proportionality, to which Article 5(1)(c) of the
GDPR
gives expression. In that regard, I note that
part (a) of the third question for a preliminary ruling, which is not the subject of the present targeted Opinion, more specifically concerns the examination of proportionality.
29      See judgments of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications) (C‑746/18, EU:C:2021:152, paragraphs 41 to 44),
and of 5 April 2022, Commissioner of An Garda Síochána and Others (C‑140/20, EU:C:2022:258, paragraph 127).
30      (ECtHR).
31      Signed in Rome on 4 November
1950.
32      See ECtHR, 12 May 2000, Khan v. United Kingdom (CE:ECHR:2000:0512JUD003539497, § 34 and the case-law cited), and
ECtHR, 10 March
2009, Bykov v. Russia (CE:ECHR:2009:0310JUD000437802, §§ 88 and 89 and the case-law cited). See, also, ECtHR, 15 January
2015, Dragojević v. Croatia (CE:ECHR:2015:0115JUD006895511, § 129), and ECtHR, 16 February
2021, Budak v. Türkiye (CE:ECHR:2021:0216JUD006976212, § 71), in which the ECtHR
added that, in determining whether the proceedings as a whole were fair, regard must also be had to whether the rights of the defence were respected, which entails examining, in particular, whether
the applicant was given the opportunity of challenging the authenticity of the evidence and of opposing its use, and taking into consideration the
quality of the evidence, including whether the circumstances in which it was obtained cast doubt on its reliability or accuracy.
33      See judgment of 6 October 2020, La Quadrature du Net and Others (C‑511/18, C‑512/18 and
C‑520/18, EU:C:2020:791, paragraphs 221, 222, 225 to 227), concerning, inter alia, the question of whether
EU law precludes the use, in criminal proceedings, of information and evidence obtained in contravention of the requirements stemming from Directive 2002/58/EC of the European Parliament and of the Council
of 12 July 2002 concerning
the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37).
34      The German Government adds that Paragraphs 138, 286, 355 et seq.
of the Code of Civil Procedure
are aimed as a whole at establishing the facts relevant for the purposes of the judgment, and that the combined provisions of Paragraph 286
of that code
and of Paragraph 103(1) of the
Basic Law
mean that
courts are, in principle, required to
take into consideration
the facts stated by the parties
and the evidence provided by them.
35      See Bundesverfassungsgericht (Federal Constitutional Court), decision of 9 October 2002 (1 BVR 1611/96, BVerfGE 106, 28-51, DE:BVerfG:2002:rs20021009.1bvr161196, paragraph 60).
36      The 2nd Chamber of the Bundesarbeitsgericht (Federal Labour Court) therefore held, in a judgment of 29 June 2023 (2 AZR 297/22, DE:BAG:2023:290623.U.2AZR297.22.0), that such a conclusion
clearly followed from Article 17
of the GDPR. The German Government confirms that reading of the judgment in question. It adds, in essence, that, in accordance with that case-law, the court may also be called upon to rule out certain evidence where its use would constitute
a serious breach of the fundamental rights
of a party to the proceedings. In that regard, I should note that the question as to the possibility
for individuals of being able to exercise their rights
where they have a justified probative interest falls more specifically within
part (c) of the third question for a preliminary ruling,
which is not the subject of the present targeted Opinion.
37      See the judgment in
Norra Stockholm Bygg (paragraph 40).
38      See recital 41 of the GDPR
and, to that effect, the judgments in
Valsts ieņēmumu dienests (paragraphs 52 and 56), and of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV (C‑17/22 and
C‑18/22, EU:C:2024:738, paragraph 71).
39      The Court has accordingly previously held that national law provisions involving
production of a document as evidence
are capable of falling within the scope of cases of personal data processing regarded as lawful under the provisions of Article 6(3) and
(4) of the GDPR, read in combination with Article 23(1)(f) and
(j) thereof (see the judgment in Norra Stockholm Bygg (paragraph 45)), or even that, where a court or tribunal exercises the judicial powers conferred on it by national law, the processing of personal data which that court or tribunal is called upon to carry out must be regarded as necessary for the purpose set out in point
(e) of the first subparagraph of Article 6(1) of that regulation
(see judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox) (C‑60/22, EU:C:2023:373, paragraph 73)).