The extent to which, and how, GDPR Data Protection Principles apply when organisations are handling data in the context of litigation, has recently been considered by the Court of Justice of the European Union. The Advocate General’s opinion may be considered by UK courts seeking to interpret the scope and application of the UK GDPR
Disclosure and data protection
Increasing awareness by individuals of their data protection rights, such as your own right to access your personal data, has led to greater recognition that the litigation process carries significant risk where disclosure involves personal data. UK GDPR permits the processing of personal data where necessary to comply with a legal obligation. Additional legal bases for processing are available where special category data is involved due to its sensitive or personal nature. Although such processing is allowed, an organisation is still obliged to comply with data protection principles when disclosing personal data for use as evidence in legal proceedings.
The need for evidence v. protection of data subjects
In the recent case of Norra Stockholm Bygg AB v Per Nycander AB, joined parties: Entral AB (Case C‑268/21) EU:C:2022:755, the Court of Justice of the European Union was asked to consider a court order for disclosure of a staff register for use as evidence in civil proceedings. This would entail the processing of personal data.
The register had been collected to record the presence of staff on a construction site. A dispute arose about compensation for the work carried out. Disclosure of the register was requested to evidence the time spent on the work. The Claimant refused to disclose the register, saying that the data had been collected for another purpose and that allowing the Defendant access would unduly infringe the data subjects' interests.
The Advocate General's opinion makes it clear that the rules applying to court proceedings must be applied in conformity with the GDPR. Although procedural rules requiring disclosure of evidence provide a lawful basis for processing personal data, this on its own is not enough to conform with GDPR. The court must balance the interests of the litigants who wish to obtain evidence, against the interests of the data subjects whose personal data is being processed. To do this any disclosure must be proportionate. A data subject will usually have an interest in restricting processing so a court ordering disclosure must justify why this interest should be interfered with. The principle of data minimisation – only processing the minimum personal data necessary to achieve the intended aim – was highlighted.
Norra Stockholm Bygg AB v Per Nycander AB, joined parties
Our content explained
Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.