CJEU - C-268/21 - Norra Stockholm Bygg
| CJEU - C‑268/21 Norra Stockholm Bygg | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 6(3) GDPR Article 6(4) GDPR |
| Decided: | |
| Parties: | |
| Case Number/Name: | C‑268/21 Norra Stockholm Bygg |
| European Case Law Identifier: | |
| Reference from: | |
| Language: | 24 EU Languages |
| Original Source: | |
| Initial Contributor: | Bernardo Armentano |
vvvvv
English Summary
Facts
The company Fastec was contracted by the company Nycander for the construction of an office building. During the project, workers who carried out activities at the construction site registered their presence through an electronic record system.
After completion of the work, Fastec filed a lawsuit with the Swedish Court of First Instance to collect a debt related to the services provided, including the hours worked by its staff.
In response, Nycander claimed that the number of hours worked was lower than that presented by Fastec and requested the presentation of the electronic record for proof purposes.
Fastec opposed this request, on the grounds that the disclosure odf the records would violate the provisions of article 5(1)(b) GDPR, as it personal data from the staff members were collected for the purpose of complying with legal tax obligations.
The Court of First Instance granted Nycander's request and ordered the presentation of the unedited records for the period in which the work was carried out. In the second instance, the decision was confirmed. However, Fastec filed an appeal with the Supreme Court of Sweden and asked for the decision to be reversed.
The Supreme Court then decided to stay the proceedings and refer the following preliminary questions to the CJEU:
1. Does Article 6(3) and (4) of the GDPR also impose a requirement on national procedural legislation relating to [the obligation to produce documents]?
2. If Question 1 is answered in the affirmative, does the GDPR mean that regard must also be had to the interests of the data subjects when a decision on [production] must be made which involves the processing of personal data? In such circumstances, does EU law establish any requirements concerning how, in detail, that decision should be made?'
Holding
To answer the first question, the CJEU understood that it was necessary to determine whether personal data collected for the fulfillment of a legal tax obligation could be used for a different purpose, that is, for the production of evidence in legal proceedings.
Firstly, it noted that, according to Article 6(1)(e) GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Also, it recalled that, in accordance with Article 6(3) GDPR, read in combination with Recital 45 thereof, this task must be defined by EU law or by Member State law to which the controller is subject. From the combination of the two articles, the CJEU held that the tasks performed by courts acting in their judicial capacity fall under this notion.
Secondly, it pointed out that, where the processing of personal data is carried out for a purpose other than that for which those data have been collected, it follows from Article 6(4) of the GDPR, read in the light of recital 50 thereof, that such processing is allowed provided that it is based, inter alia, on Member State law and that it constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) of the GDPR. In such cases, the controller is allowed to further process personal data irrespective of the compatibility of that processing with the purposes for which the personal data were initially collected.
In the present case, the CJEU found that the legal basis for the use of the records as evidence in a judicial proceeding is provided for by the national procedural law, while the legal basis for collection of such data by the employer is provided for by the national tax law. The first is intended to enable citizens to exercise their rights through access to evidence; the second is intended to enable tax authorities to exercise their inspection powers.
Considering that these are different purposes, but both defined by law, the CJEU held it necessary to analyze not the compatibility between them, but the necessity and proportionality of the measure under Article 6(4) GDPR, in accordance with the objectives referred to in Article 23(1) GDPR. It recalled that these objectives include the protection of judicial independence and judicial proceedings, which encompasses the protection of the the proper administration of justice. Moreover, according to Article 23(1)(j), the enforcement of civil law claims also constitutes an objective which may justify further processing of personal data.
However, it emphasized that it is for the referring court to ascertain whether the relevant provisions meet one and/or other of those objectives and if they are necessary and proportionate to the said objectives. In that regard, it is irrelevant that the processing of personal data is based on a provision of substantive or procedural national law, since the provisions of Article 6(3)(b) and (4) of that regulation make no distinction between those two types of provision.
In the light of all the foregoing considerations, the CJEU found that Article 6 (3) and (4) GDPR must be interpreted as meaning that that provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection.
Regarding the second question, the CJEu understood that it was necessary to define whether, when issuing an order for the production of evidence, the judge should consider the interests of data subjects.
The CJEU stressed that, although the national procedural law does not stipulate this obligation, any activity involving the processing of personal data must comply with the principles of Article 5 GDPR and be supported by one of the legal basis provided for in Article 6 GDPR.
Thus, when information is simultaneously considered as personal data and potential evidence in a judicial process, the judge must carry out a weighing exercise before determining the production of evidence. According to the Court, this exercise must take into account the interests in conflict, which must be done on a case-by-case basis.
Although the right to data protection is considered fundamental, it is not an absolute right. Therefore, there is a need to make it compatible with other fundamental rights, such as the right to effective judicial protection. According to the settled case-law of the European Court of Human Rights, an individual have the right to present his or her case effectively before the court and enjoy equality of arms with the opposing side. It follows, inter alia, that an individual must have the benefit of adversarial proceedings and be able to submit, at various stages of those proceedings, the arguments he or she considers relevant to his or her case. Therefore, in order to ensure that individuals can enjoy a right to effective judicial protection and, in particular, a right to a fair trial, within the meaning of the second paragraph of Article 47 of the Charter, the parties to civil court proceedings must be in a position to access the evidence necessary to establish to the requisite standard the merits of their complaints, which may possibly include personal data of the parties or of third parties. In view of this, the national Court must analyze whether data disclosure constitutes a measure that is proportional and necessary for the objective in question, in order to guarantee the minimization of data imposed by Article 5(1)(c).
In the event that the production of a document containing personal data proves to be justified, it also follows from that principle that, where only part of those data appears necessary for evidential purposes, the national court must consider taking additional data protection measures, such as the pseudonymisation, defined in Article 4(5) of the GDPR, of the names of the data subjects or any other measure intended to minimise the interference with the right to the protection of personal data resulting from the production of such a document. Such measures may include limiting public access to the file or an order addressed to the parties to whom the documents containing personal data have been disclosed not to use those data for a purpose other than the taking of evidence during the court proceedings at issue.
In the light of all the foregoing considerations, the answer to the second question is that Articles 5 and 6 of the GDPR must be interpreted as meaning that, when assessing whether the production of a document containing personal data must be ordered, the national court is required to have regard to the interests of the data subjects concerned and to balance them according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation referred to in Article 5(1)(c) of that regulation.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
