Disclosure of personal data used as evidence in legal proceedings

The extent to which, and how, GDPR Data Protection Principles apply when organisations are handling data in the context of litigation, has recently been considered by the Court of Justice of the European Union. The Advocate General’s opinion may be considered by UK courts seeking to interpret the scope and application of the UK GDPR

Disclosure and data protection

Increasing awareness by individuals of their data protection rights, such as your own right to access your personal data, has led to greater recognition that the litigation process carries significant risk where disclosure involves personal data. UK GDPR permits the processing of personal data where necessary to comply with a legal obligation. Additional legal bases for processing are available where special category data is involved due to its sensitive or personal nature. Although such processing is allowed, an organisation is still obliged to comply with data protection principles when disclosing personal data for use as evidence in legal proceedings.

The need for evidence v. protection of data subjects

In the recent case of Norra Stockholm Bygg AB v Per Nycander AB, joined parties: Entral AB (Case C‑268/21) EU:C:2022:755, the Court of Justice of the European Union was asked to consider a court order for disclosure of a staff register for use as evidence in civil proceedings. This would entail the processing of personal data.

The register had been collected to record the presence of staff on a construction site. A dispute arose about compensation for the work carried out. Disclosure of the register was requested to evidence the time spent on the work. The Claimant refused to disclose the register, saying that the data had been collected for another purpose and that allowing the Defendant access would unduly infringe the data subjects' interests.

The Advocate General's opinion makes it clear that the rules applying to court proceedings must be applied in conformity with the GDPR. Although procedural rules requiring disclosure of evidence provide a lawful basis for processing personal data, this on its own is not enough to conform with GDPR. The court must balance the interests of the litigants who wish to obtain evidence, against the interests of the data subjects whose personal data is being processed. To do this any disclosure must be proportionate. A data subject will usually have an interest in restricting processing so a court ordering disclosure must justify why this interest should be interfered with. The principle of data minimisation – only processing the minimum personal data necessary to achieve the intended aim – was highlighted.

Norra Stockholm Bygg AB v Per Nycander AB, joined parties

Our content explained

Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.

Posted by


Mills & Reeve Sites navigation
A tabbed collection of Mills & Reeve sites.
My Mills & Reeve navigation
Subscribe to, or manage your My Mills & Reeve account.
My M&R


Register for My M&R to stay up-to-date with legal news and events, create brochures and bookmark pages.

Existing clients

Log in to your client extranet for free matter information, know-how and documents.


Mills & Reeve system for employees.