CJEU rules that national courts must consider the interests of individuals when ordering data disclosure in civil litigation

When assessing whether the production of a document containing personal data must be ordered, a national court must consider the interests of the data subjects concerned and balance them according to the circumstances of each case, the type of proceeding at issue and taking into account the GDPR principles of proportionality and data minimisation.

This case concerns a civil claim by Fastec, a building contractor, against Nycander, its client, for payment of outstanding invoices for construction work. The work was performed by Fastec's employees, whose presence on the building site was recorded, for tax purposes, in a staff register  maintained on Fastec's behalf by a third-party service provider Entral AB. Nycander sought disclosure of the staff register, either unredacted or with only the personal identity numbers of the workers concealed, as evidence of the actual work done. Fastec resisted that disclosure, arguing that it would infringe Article 5(1)(b) GDPR. The Swedish Supreme Court referred the case to the CJEU for a preliminary ruling on the interpretation and application of the GDPR in this context.

The CJEU ruled that the GDPR applies to such a disclosure. It said that Article 6(3) and (4) GDPR must be interpreted as meaning that the provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection. 

The CJEU further considered the criteria that national courts must apply when assessing whether to order the production of a document containing personal data. The CJEU held that, in making this assessment, the court must respect the interests of the data subjects concerned and weigh them according to the circumstances of each case, the type of proceeding at issue and the principles of proportionality and data minimisation. The court must establish whether the disclosure is adequate and relevant for achieving the objective pursued and whether there is a less intrusive means of proof available, such as the examination of selected witnesses.

The CJEU also stated that a national court may consider that it needs to receive the personal data of the parties or of third parties in order to balance, with full knowledge of the facts and in accordance with the principle of proportionality, the interests at stake. Depending on the case, the national court  may authorise the full or partial disclosure of personal data to the opposing party if it determines that such disclosure does not go beyond what is necessary for the purpose of ensuring the effective exercise of the rights to an effective remedy and to a fair trial that individuals enjoy under Article 47 of the Charter of Fundamental Rights of the EU.

Read the CJEU decision.