Case C-484/24, NTH Haustechnik: Request for a preliminary ruling from the Landesarbeitsgericht Niedersachsen (Germany) lodged on 10 July 2024 – NTH Haustechnik GmbH v EM
Date: 2024-07-10
Institutions: Court of Justice
Subjects: administrative sanction, civil proceedings, data protection, data-processing law, labour dispute, personal data, proof, protection of privacy, right to an effective remedy, right to justice








C_202406402EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2024/6402


4.11.2024






Request for a preliminary ruling from the Landesarbeitsgericht Niedersachsen (Germany) lodged on 10 July 2024 – NTH Haustechnik GmbH v EM


(Case C-484/24, NTH Haustechnik)

(C/2024/6402)
Language of the case: German

Referring court

Landesarbeitsgericht Niedersachsen

Parties to the main proceedings


Applicant: NTH Haustechnik GmbH

Defendant: EM

Questions referred







1.


Do the provisions of Article 92 of the Grundgesetz (Basic Law, ‘the GG’), Paragraphs 138, 286, 355 et seq. of the Zivilprozessordnung (Code of Civil Procedure, ‘the ZPO’) in the case of an independent judicial processing activity falling under Article 6(1)(e), (3) of the GDPR (1) fulfil the requirement of certainty arising from Article 8(2), Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the CFR’) and Article 5(1)(c) of the GDPR if the judicial processing activity involves interference with fundamental rights for a party or a third party?










2.








a)


When processing data – in particular personal data – can a national court rely on the fact that such processing is authorised under Article 17(3)(e) of the GDPR, or do Articles 6 and 9 of the GDPR constitute the exclusive basis for judicial processing activities?










b)


If Article 17(3)(e) of the GDPR can in principle form a legal basis for judicial processing activities:










(aa)


Does this also apply to cases in which the original collection of those data by a litigant or a third party was not lawful?










(bb)


Does the processing of originally unlawfully collected data under the generally applicable principle of good faith (Article 5(1)(a) of the GDPR) lead to a restriction of judicial processing under secondary law in the sense that Article 17(3)(e) of the GDPR is only applicable under certain conditions or within certain limits?










(cc)


Is the provision in Article 17(3)(e) of the GDPR to be understood in such a way that a prohibition on the judicial utilisation of originally unlawfully obtained data is always excluded – i.e. the court must always utilise those data – if the original data collection was not covert and was used to prove an intentional breach of duty?














3.


Irrespective of whether the judicial data processing activity is subject to Article 17(3)(e) of the GDPR or Article 6(1)(c) or (e), (3), Article 9 of the GDPR or other provisions of EU law:






a)


Do the principles of necessity and data minimisation under data protection law pursuant to Article 52(1) sentence 2 of the CFR, Article 5(1)(a) of the GDPR, in particular with regard to the processing of originally unlawfully collected or stored data, give rise to the need for a comprehensive proportionality test and balancing by the courts?










b)


What impact does Article 5(1)(e) of the GDPR, which stipulates that personal data may be kept for no longer than is necessary for the purposes for which such data are processed, have on subsequent judicial data processing activities, in particular in cases where






—


the original data collection served other purposes, or










—


the original unlawful data collection took place a long time ago, or










—


unlawful storage has been maintained for longer periods of time, or










—


the unlawful data collection concerns data that were stored a long time ago – possibly unlawfully, or










—


the data processing or collecting body or person has undertaken, either unilaterally or under individual contract or collective law, to erase the data within a certain period of time, but has not done so?














c)


Does it follow from EU law, in particular from Article 8 of the CFR, Article 6(1)(c) or (e), (3), Article 9 of the GDPR, that the national court can utilise evidence that was obtained in violation of personal rights only if there is a recognisable interest of the party bearing the burden of proof that goes beyond the simple interest in evidence, or do no requirements follow from EU law in this respect, such that it is up to the national legal system to make provisions in that regard?










d)


Does it follow from Article 47(2) of the CFR, which guarantees the right to effective judicial protection and, in particular, to a fair trial, according to which the parties to civil proceedings must in principle be able sufficiently to substantiate and prove their legal protection objective, that the judicial processing of personal data of the applicant employee unlawfully collected by the employer can only be inappropriate and disproportionate in the narrower sense if the data collection under EU law would prove to be a serious infringement of Article 7 and Article 8 of the CFR and other possible sanctions for the employer (e.g. compensation for damages under Article 82 of the GDPR and the imposition of fines under Article 83 of the GDPR) would be completely inadequate, or can inappropriateness and disproportionality be established even in the case of other, less serious breaches of data protection law during the original data collection?










e)


When deciding whether to utilise the data originally collected from a party or a third party as part of its judicial data processing activities, does the court have to take into account whether the data collector has complied with its information obligations under Article 13 of the GDPR? If so: Under what conditions and according to what standards must the court take this into account?










f)


Does the fact that the Court is bound by the GDPR and the Charter of Fundamental Rights of the European Union when processing personal data also include the personal data of third parties? In what way does a possible breach of data protection law in the original data collection have an effect on any subsequent judicial data processing in a dispute between two parties? Can a party rely on an offence committed not against it but against third parties, or is that not the case?










(1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, ‘GDPR’) (OJ 2016 L 119, p. 1).


ELI: http://data.europa.eu/eli/C/2024/6402/oj
ISSN 1977-091X (electronic edition)