NTH Haustechnik GmbH – CJEU Judgment (European Union, 2025)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice ruled that NTH Haustechnik GmbH unlawfully accessed an ex-employee's private eBay account to gather evidence. This matters because it shows that companies must follow strict rules when handling personal data, even in legal disputes. Companies should ensure they have a valid reason to access personal information.
What happened
NTH Haustechnik GmbH accessed an ex-employee's private eBay account without legal grounds.
Who was affected
The ex-employee of NTH Haustechnik GmbH whose private data was accessed unlawfully.
What the authority found
The Court held that the company collected and stored personal data unlawfully, violating GDPR rules.
Why this matters
This ruling emphasizes that companies must respect privacy rights when gathering evidence. It sets a precedent that could impact how businesses handle personal data in legal situations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
A data subject was an employee of a heating and air conditioning business. The data subject ceased working at the company, however, was still able to access the company’s premises and computers through their managing director for several years. The company brought a case against the data subject, on the grounds that the data subject had sold equipment belonging to the company through eBay. The company sought damages based on this. The German Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) stayed proceedings and requested a preliminary ruling from the CJEU. The data protection issue in this case is that the company became aware of the transactions by accessing the data subject’s private eBay account (how the company received the ID and password is disputed). According to the Court, the company collected and stored the data unlawfully. The Court also considered that it carried out data processing in assessing the evidence during the proceedings, and asked for clarification regarding national legislation for judicial data processing activities and their legal bases. The Court referred the following questions: # Do national provisions involving an independent judicial processing activity under public interest (Article 6(1)(e) GDPR) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Can a court rely solely on Article 17(3)(e) GDPR to process personal data? If yes: ## Does this still apply if the initial data collection is unlawful? ## Does the principle of fairness (Article 5(1)(a) GDPR) restrict the applicability of Article 17(3)(e) GDPR? ## Must Article 17(3)(e) GDPR be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisat
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for NTH Haustechnik GmbH in EU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
1 January 2025
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-9557About this data
Cite as: Cookie Fines. NTH Haustechnik GmbH - European Union (2025). Retrieved from cookiefines.eu
Last updated: