June 18, 2026 | Civil Lawsuit Ruling | Data Governance

On 18 June 2026, the Court of Justice of the European Union (CJEU) issued a preliminary ruling in Case C-484/24, referred by the Higher Labour Court of Lower Saxony, Germany, concerning the application of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) to national courts when handling evidence that a party may have collected unlawfully. The CJEU ruled, first, that national procedural legislation need not specify the conditions under which courts may use personal data in evidence, provided that clear and foreseeable national case-law itself establishes those conditions, meets an objective of public interest, and is proportionate to that objective. Second, Article 17(3)(e) of the GDPR does not constitute a standalone lawfulness condition for processing. Lawfulness must be established under Article 6(1). Third, the data minimisation principle under Article 5(1)(c) does not require courts to conduct a full proportionality balancing exercise for each piece of evidence processed, provided the Article 5(1)(c) conditions are met. Fourth, courts may use evidence containing personal data obtained in breach of privacy rights by the transmitting party, even where that party's legitimate interest does not outweigh the mere interest in adducing evidence, but must verify that data disclosed to parties or third parties is limited to what is necessary. Fifth, failure by a party to comply with Article 13 information obligations does not bar a court from using the data collected. Sixth, courts must comply with the GDPR when processing personal data relating to third parties, but EU law does not require a party to rely on GDPR violations committed against those third parties.