CJEU rules on applicability of the GDPR in civil proceedings
On 2 March 2023, the European Court of Justice issued a ruling that examines whether and to what degree provisions of the General Data Protection Regulation (GDPR) apply in the context of civil court proceedings in EU member states.
The question raised was whether personal data collected for tax-related purposes could be used as evidence – thus under a different purpose than its original intention.
On this issue, the ECJ determined that GDPR requirements are validly enforceable when pertaining to national civil procedural law within the EU.
While not unexpected, this decision has a far-reaching impact, since it implies courts must abide by GDPR principles when processing personal data in connection with litigation. This not only applies to evidence submitted during proceedings but also encompasses any other type of data processing throughout the whole process – from commencement to enforcement.
Under German law, parties should take into account Section 24(1) No. 2 of the Federal Data Protection Act (BDSG), which permits the alteration of a data processing purpose if deemed necessary for the settlement, exercise or defence of a legal claim, provided this would not prejudice the interests of the data subject.
Source: Europe: Applicability of the GDPR in civil proceedings – Privacy Matters
