On March 2, 2023, the Court of Justice of the EU (“CJEU”) decided, in case C-268/21, that the GDPR applies to the production of evidence in civil court proceedings. The case sets limits on, but does not preclude, the production of personal data in court proceedings.
The case arose from a dispute between a construction company and its customer concerning payment for construction works. The customer requested a Swedish court to order the construction company to provide a copy of its electronic staff register containing, among other things, the identity of the people involved in the construction works and the hours they had worked – construction companies are required to maintain such a registry under Swedish tax law. The construction company opposed the order, claiming that the reuse of the register in the context of a civil dispute was incompatible with the initial purpose of the register and therefore not allowed under GDPR. The Swedish Supreme Court referred the matter to the CJEU seeking answers on (i) whether the GDPR applies to the production of evidence containing personal data in court proceedings; and (ii) whether national courts, when assessing whether the production of evidence containing personal data has to be ordered, should have regard to the interests of the data subjects concerned.
The CJEU found that the production of evidence containing personal data ordered by a court in the context of judicial proceedings constitutes data processing under the GDPR. The CJEU also held that, in this case, providing the register under a court order served a different purpose (i.e., civil proceedings) from the one for which the data had been collected initially (i.e., tax compliance).
However, according to the court, this “secondary use” of the register was permissible on the basis of Article 6(1)(e), (3) and (4) GDPR, because the “secondary use” was made under a national or EU law seeking to safeguard an objective referred to in Article 23(1) of the GDPR. The CJEU held that the proper administration of justice – for example through the production of documents to court – was one of those objectives. The result of this is that, in assessing whether disclosure of documents in court proceedings is consistent with GDPR, national courts will have to conduct an assessment on a case-by-case basis of whether the relevant provisions of national or EU law under which the disclosure are being disclosed meet one of those objectives in Article 23(1) of the GDPR and whether the disclosures are necessary and proportionate to meet those objectives. Where only a partial disclosure of personal data is justified, the court should consider data minimization measures, such as pseudonymization.
Other national developments
Similar questions have been raised at the national level.
On March 8, 2023, the French Court of Cassation held that the right to obtain evidence in civil procedures can justify the production of documents affecting the personal lives of third parties. The case related to the production of pay slips of other employees, which were essential evidence for the claimant’s allegation that their employer had violated equal-pay laws. The Court held that such production of documents was permissible provided that the documents formed essential evidence for the claimant’s claim, and that the interference with privacy was proportionate to the aim pursued. However, courts will still have to limit access to documents to what is strictly necessary.
On January 11, 2023, the Italian Garante decided that the production in civil law proceedings of a former consultant’s email communications was unlawful under data protection law. The dispute arose from a complaint concerning a company’s access to e-mails sent by a former consultant using their company e-mail account. In the context of civil proceedings, which occurred following the termination of the consultant’s agreement with the company, the company accessed the e-mails and produced some of them as evidence.
The Garante decided that the right to produce evidence does not waive the right to data protection, especially where the data concerned (electronic communications) is subject to special guarantees of secrecy under the Italian Constitution. In particular, the Garante held that the company’s legitimate interest in processing personal data to defend its own rights in court did not invalidate the consultant’s right to protection of their personal data. Unlike the two decisions above, this case involved the proactive disclosure of a third party’s personal data in a proceeding by one of the parties – not a document production ordered by a court.
* * *
Covington’s Data Privacy and Cybersecurity Practice monitors CJEU and national cases closely and reports on relevant Court decisions and Advocate General opinions. If you have any questions about the interaction between data protection and local laws we are happy to assist.