On 2 March 2023, the Court of Justice of the European Union (CJEU) delivered its ruling in Case C‑268/21 (Norra Stockholm Bygg).
In essence, the CJEU was asked for a preliminary ruling on the following:
- whether Article 6 (3) and (4) of the GDPR must be interpreted as meaning that these provisions apply in the context of the civil court proceedings to the usage of a register containing personal data of third parties collected for tax inspection, as evidence;
- whether Articles 5 and 6 of the GDPR must be interpreted as meaning that the national court is required to analyze the interests of the data subjects when assessing a document containing personal data to be presented before the court and whether there are any specific requirements on how to make such assessment.
CJEU stated that the national court should assess whether the national provisions laying down the possibility for the courts to order the production of a document as evidence constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23 (1) of the GDPR. Any processing of personal data must, subject to the derogations within Article 23 of the GDPR, comply with the principles applicable to the processing of personal data and the rights of the data subjects.
For these purposes, when assessing whether to order the production of a document containing personal data, the national court must observe the opposing interests involved, having also regard to the circumstances of the case and the type of proceedings.
CJEU highlighted that any processing of personal data must, subject to the derogations within Article 23, comply with the principles applicable to the processing of personal data (in particular, the data minimization principle) and the rights of the data subjects. The personal data must be adequate, relevant, and limited to what is necessary to achieve the objective pursued by the applicable national provisions. The national court is also required to assess whether less intrusive means of evidence could be used to attain the same objective (e.g., the hearing of a witness).
When only part of the data contained by the document is necessary as evidence, the national court must consider protecting the personal data by taking additional measures, such as pseudonymization, the limitation of public access to the court file, or expressly order the parties to not use those data for other purposes.
