NTH Haustechnik GmbH – CJEU Judgment (European Union, 2026)

A data subject was an employee of a heating and air conditioning business. The data subject ceased working at the company, however, was still able to access the company’s premises and computers through their managing director for several years. The company brought a case against the data subject, on the grounds that the data subject had sold equipment belonging to the company through eBay. The company sought damages based on this. The German Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) stayed proceedings and requested a preliminary ruling from the CJEU. The data protection issue in this case is that the company became aware of the transactions by accessing the data subject’s private eBay account (how the company received the ID and password is disputed). According to the Court, the company collected and stored the data unlawfully. The Court also considered that it carried out data processing in assessing the evidence during the proceedings, and asked for clarification regarding national legislation for judicial data processing activities and their legal bases. The Court referred the following questions: # Do national provisions involving an independent judicial processing activity under public interest (Article 6(1)(e) GDPR) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Data processing by a court: ## Can a court rely solely on Article 17(3)(e) GDPR to process personal data? ## If yes: ### Does this still apply if the initial data collection is unlawful? ### Does the principle of fairness (Article 5(1)(a) GDPR) restrict the applicability of Article 17(3)(e) GDPR? ### Must Article 17(3)(e) GDPR be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation? ## What impact does the principle of storage limitation (Article 5(1)(e) GDPR) have on judicial data processing activities? ## Under EU law, can a court use evidence obtained unlawfully only if there is a recognisable interest of the party bearing the burden of proof, or is it the competence of the national legal system to make provisions in that regard? ## Are possible sanctions for the employer under the GDPR appropriate only if it is considered a serious infringement, or do they apply for less serious breaches at the initial moment of collecting the data? ## Must a court take into consideration whether the party collecting the data has complied with its obligations under Article 13 GDPR? ## Do data protection responsibilities of the court extend to the personal data of third parties? How does a possible unlawful data processing affect judicial proceedings? The AG provided an opinion on question 3(2). The AG first made a distinction between the data involved; on one hand, the data subject’s data stored in the company server and company devices (“initial data”). On the other hand, the data from the eBay website used by the company to bring an action against the data subject (“data relating to the sales”). The AG suggested that to reformulate the question to assess whether the principle of storage limitation, read in conjunction with Article 6 GDPR, imposes specific requirements on national courts to process data that has been previously unlawfully processed. In answering the question, the AG noted that any data processing activity must comply with the principles of the GDPR, including lawfulness in accordance with Article 6 GDPR. In this case, processing of data by the court may be lawful under public interest (Article 6(1)(e) GDPR). Nonetheless, the AG stated that the controller may only store data for as long as necessary, meaning initially lawful processing can become unlawful if processed for longer than necessary. According to the AG, neither Article 5(1)(e) nor 6(1)(e) GDPR contain an absolute prohibition preventing a public authority (such as a court) to process data that is processed unlawfully. In the absence of EU rules, it is for the national law to establish procedural rules while respecting the principle of equivalence and effectiveness of EU law. Limitations must also comply with [https://fra.europa.eu/en/eu-charter/article/52-scope-and-interpretation-rights-and-principles Article 52(1) of the EU Charter of Fundamental Rights]. Finally, the AG noted that EU law does not govern the admissibility of evidence in national judicial proceedings. Taking into account the obligation of courts to establish the truth based on evidence provided, the AG opined that there is a national legal basis (within the meaning of Article 6(3)(b), read in conjunction with 23(1)(j) GDPR) for the court to process the personal data. == The court first clarified that it assessed the answer to this question in light of Article 6(1)(c) GDPR as a legal basis rather than Article 6(1)(e) GDPR. This is because the referring court processed data (evidence presented by the parties) in order to comply with its legal obligation of assessing the evidence and making a decision. The court also clarified that it is for national law alone to determine the rules on admissibility and assessment of facts and evidence.See case C‑511/18, C‑512/18 and C‑520/18 La Quadrature du Net and Others, margin 223 and case C‑140/20 Commissioner of An Garda Síochána and Others, margin 127 The court determined that the GDPR is applicable and that the referring court processed personal data when assessing evidence, in particular when placing documents with personal data in a file. However, the referring court must determine whether the processing in this case falls under the GDPR. The GDPR lays additional requirements for processing under Article 6(1)(c) GDPR to be lawful. The court highlighted that Article 6(3) GDPR requires the processing to have a legal basis under national law. This legal basis must also meet an objective of public interest and be proportionate to that objective. The court noted that the national law provisions at issue did not lay down conditions in order for evidence containing personal data that was initially unlawfully processed to be considered admissible. The court considered that the GDPR does not preclude such national provisions, providing that there is clear and precise national case law that establishes these conditions. Case law must also meet an objective of public interest and be proportionate to that objective.The court considered the conditions required under the CFREU and ECHR to limit the right to privacy and data protection. The court referred to case law from the ECtHR, which states that the term “law” under Article 8(2) of the ECHR must be understood in a substantive and not formal sense, meaning it may also include case law. See ECtHR, 23 January 2025, H.W. v. France, CE:ECHR:2025:0123JUD001380521, margin 65 == Article 6(1) GDPR sets an exhaustive and restrictive list of legal bases for which a processing activity is considered lawful. The court stated that while Article 17(3)(e) GDPR introduces an exception to data subjects’ right to erasure, it does not create an autonomous legal basis for the processing of personal data for the establishment or exercise of legal claims. This Article would be insufficient to comply with Article 5(1)(a) GDPR. Therefore, the court considered there was no need to answer the question 2(2) and its sub questions. == Question 3(1): Must the court carry out a comprehensive proportionality test? The court highlighted that under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 52(1) CFREU], a limit to the exercise of a fundamental right must meet the requirements of proportionality and necessity. In terms of proportionality, the measure must allow the objectives to be met, the interference must be limited to what is strictly necessary, and there must be a balancing test between the objectives and the seriousness of the interference.The court noted that the principle of data minimisation (Article 5(1)(c) GDPR gives expression to the principle of proportionality. However, it does not in itself implement the principle (and therefore the conditions needed to fulfil it). The court noted that a processing activity complies with the first two conditions of proportionality if it complies with the principle of data minimisation. For the third condition, the court stated that, in principle, compliance with Article 6(1) GDPR already limits the processing to what is necessary to achieve a legitimate objective. This includes processing with a legitimate interest that outweighs the seriousness of the interference with the fundamental rights under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Articles 7 and 8 CFREU]. Here, the court reiterated that processing under Article 6(1)(c) GDPR must also comply with the requirements of Article 6(3) GDPR. Therefore, the referring court must comply with the requirements of data minimisation and Article 6(3) GDPR (proportionality and balancing of interests). However, the principle of data minimisation does not require the referring court to ensure that the principle of proportionality is observed for every processing of personal data it undertakes. Questions 3(2) to (4): can a court process data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully? The court first referred to the AG’s opinion, and stated that the GDPR does not lay an absolute prohibition preventing a public authority from taking into account personal data that was previously unlawfully processed by the person who transmitted the data to such authority. The court stated that a court has the obligation to rule on whether evidence presented by parties is admissible and to take said evidence into account to reach a decision (in accordance with national law). The processing of personal data carried out by a court in connection to these obligations is, in principle, necessary. These obligations do not appear to contradict the requirements set in Articles 6(1)(c) and 6(3) GDPR. Therefore, the principle of data minimisation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully. The court took into account the importance of the right to fair trial ([https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 47 CFREU]), and concluded that processing of personal data was not a disproportionate interference with the fundamental right to privacy and data protection. The court noted that no other measure appeared to be capable of achieving the objective as effectively as allowing courts to process personal data found in evidence presented by parties. Nonetheless, the court noted that the data processed must be limited to what is adequate, relevant and necessary, in accordance with the principle of data minimisation. Here the court made a distinction between assessing the admissibility of evidence and using that evidence to reach a decision; assessing all evidence does not infringe the principle of data minimisation. However, after finding the admissible evidence, the court must take measures to reduce the amount of data processed before placing it on file (e.g. by anonymising documents where possible). This data placed on file must, in principle, be considered to be compliant with the principle of data minimisation. Finally, when disclosing the data (e.g. when publishing the decision), the court must again limit the data processing to what is necessary for its purpose(s). Question 3(5): does the previous question also apply to data processed in violation of the initial controller's information obligations? Similarly, the court stated that Articles 13(1) and (2) GDPR do not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed in violation of the initial controller’s information obligation. The court reiterated that the GDPR does not lay an absolute prohibition on processing data that was previously unlawfully processed. Therefore, the fact that the controller did not comply with its obligations under the GDPR did not mean that transferring the evidence with personal data is unlawful. Question 3(6): the court's obligations when processing data of persons who are not a party to the proceedings Finally, the court stated that a court is required, when acting in its judicial capacity, to ensure compliance with the GDPR when processing the personal data of persons who are not a party to the proceedings.