View source for CJEU - C-268/21 - Norra Stockholm Bygg

{{CJEUdecisionBOX

|Case_Number_Name=C-268/21 Norra Stockholm Bygg
|ECLI=

|Opinion_Link=
|Judgement_Link=

|Date_Decided=
|Year=

|GDPR_Article_1=Article 6(3) GDPR
|GDPR_Article_Link_1=Article 6 GDPR#3
|GDPR_Article_2=Article 6(4) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#4
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_4=
|GDPR_Article_Link_4=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Reference_Body=
|Reference_Case_Number_Name=

|Initial_Contributor=Bernardo Armentano
|
}}

The CJEU ruled that personal data collected on the basis of [[Article 6 GDPR#1e|Article 6(1)(e)]] may be used in legal proceedings, but the judge has to consider the principle of proportionality and data minimization when determining the production of evidence.

==English Summary==

=== Facts ===
The company Fastec was contracted by the company Nycander for the construction of an office building. During the project, workers who carried out activities at the construction site registered their presence through an electronic records system.

After completion of the work, Fastec filed a lawsuit with the Swedish Court of First Instance to collect a debt related to the services provided, including the hours worked by its staff. 

In response, Nycander claimed that the number of hours worked was lower than that presented by Fastec and requested the presentation of the electronic records as evidence.

Fastec opposed this request, on the grounds that the disclosure of the records would violate the provisions of article [[Article 5 GDPR#1b|5(1)(b) GDPR]], as personal data were collected from the staff members for the purpose of complying with legal tax obligations.

The Court of First Instance granted Nycander's request and ordered the presentation of the unedited records for the period in which the work was carried out. In the second instance, this decision was confirmed. Dissatisfied, Fastec filed an appeal with the Supreme Court of Sweden and asked for the decision to be reversed.

The Supreme Court then decided to stay the proceedings and refer the following preliminary questions to the CJEU:

1. Does [[Article 6 GDPR#3|Article 6(3)]] and [[Article 6 GDPR#4|(4) of the GDPR]] also impose a requirement on national procedural legislation relating to [the obligation to produce documents]?

2. If Question 1 is answered in the affirmative, does the GDPR mean that regard must also be had to the interests of the data subjects when a decision on [production] must be made which involves the processing of personal data? In such circumstances, does EU law establish any requirements concerning how, in detail, that decision should be made?'

=== Holding ===
To answer the '''first question''', the CJEU assessed whether personal data collected for the fulfillment of a legal tax obligation could be used for a different purpose, that is, for the production of evidence in legal proceedings.

First, it noted  that, according to [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It recalled that, in accordance with [[Article 6 GDPR#3|Article 6(3) GDPR]], read in combination with [[Recitals GDPR|Recital 45]] thereof, this task must be defined by EU law or by Member State law to which the controller is subject. From the combination of the two articles, the CJEU held that the tasks performed by courts acting in their judicial capacity fall under this notion. 

Then, it pointed out that, where the processing of personal data is carried out for a purpose other than that for which those data have been collected, it follows from [[Article 6 GDPR#4|Article 6(4)]] GDPR, read in the light of [[Recitals GDPR|Recital 50]] thereof, that such processing is allowed provided that it is based, inter alia, on Member State law and that it constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in [[Article 23 GDPR#1|Article 23(1) GDPR]]. In such cases, the controller is allowed to further process personal data irrespective of the compatibility of that processing with the purposes for which the personal data were initially collected.

In the present case, the CJEU found that the legal basis for the use of personal data as evidence in a judicial proceeding is provided for by the national procedural law, while the legal basis for collection of such data by the employer is provided for by the national tax law. The first is intended to enable citizens to exercise their rights through access to evidence; the second is intended to enable tax authorities to exercise their inspection powers. Considering that these are different purposes, but both defined by law, the CJEU held it necessary to analyze not the compatibility between them, but the necessity and proportionality of the measure under [[Article 6 GDPR#4|Article 6(4) GDPR]], in accordance with the objectives referred to in [[Article 23 GDPR#1|Article 23(1) GDPR]]. It recalled that these objectives include the protection of judicial independence and judicial proceedings, which encompasses the protection of the the proper administration of justice. Moreover, according to Article [[Article 23 GDPR#1j|23(1)(j)]], the enforcement of civil law claims also constitutes an objective which may justify further processing of personal data. 

In the light of all the foregoing considerations, the CJEU found that [[Article 6 GDPR#3|Article 6(3)]] and [[Article 6 GDPR#4|(4) GDPR]] must be interpreted as meaning that that provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection.

Regarding the '''second question''', the CJE assesed whether a judge must consider the interests of data subjects when issuing an order for the production of evidence.

The CJEU stressed that, although the national procedural law does not stipulate this obligation for judges, any activity involving the processing of personal data must comply with the principles of [[Article 5 GDPR]] and be supported by one of the legal basis provided for in [[Article 6 GDPR]]. Thus, when information is simultaneously considered as personal data and potential evidence in a judicial process, the judge must carry out a weighing exercise before determining the production of evidence. According to the CJEU, this exercise must take into account the interests in conflict on a case-by-case basis. 

Although the right to data protection is considered fundamental, it is not an absolute right. Therefore, there is a need to make it compatible with other fundamental rights, such as the right to effective judicial protection. According to the settled case-law of the European Court of Human Rights, an individual have the right to present his or her case effectively before the court and enjoy equality of arms with the opposing side. It follows, inter alia, that an individual must have the benefit of adversarial proceedings and be able to submit, at various stages of those proceedings, the arguments he or she considers relevant to his or her case. For this reason, the CJEU held that the parties to civil court proceedings must be in a position to access the evidence necessary to establish to the requisite standard the merits of their complaints, which may possibly include personal data of the parties or of third parties. Also, it stated that the national Court must analyze whether data disclosure constitutes a measure that is proportional and necessary for the objective in question, in order to guarantee the minimisation of data imposed by [[Article 5 GDPR#1c|Article 5(1)(c)]].

In the event that the production of a document containing personal data proves to be justified, it also follows from that principle that wthe national court must consider determining the implementation of additional data protection measures, such as the pseudonymisation of the names of the data subjects or any other measure intended to minimise the interference with the right to the protection of personal data. Such measures may include limiting public access to the file or an order addressed to the parties to whom the documents containing personal data have been disclosed not to use those data for a purpose other than the taking of evidence during the court proceedings at issue.

In the light of all the foregoing considerations, the CJEU found that Articles 5 and 6 of the GDPR must be interpreted as meaning that, when assessing whether the production of a document containing personal data must be ordered, the national court is required to have regard to the interests of the data subjects concerned and to balance them according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation referred to in [[Article 5 GDPR#1c|Article 5(1)(c)]] of that regulation.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''