CJEU: courts ordering disclosure must consider data subject interests

Norra Stockholm Bygg AB v Per Nycander AB, joined parties: Entral AB (Case C 268/21) EU:C:2022:755

In recent case law, the Court of Justice of the European Union (CJEU) has ruled that:

1. the General Data Protection Regulation (GDPR) applies to the production of evidence of a document if it contains personal data even if it is ordered by a court in the context of disclosure obligations in legal proceedings; and

2. that same court ought to consider the interests of data subjects when ordering production of such a document.

Case Summary

Norra Stockholm Bygg AB (Norra) implemented the construction of a building for Per Nycander AB (Nycander). Norra’s employees carrying out the work recorded their time in an electronic staff register for tax purposes. Entral AB provided the register, on behalf of Norra.

A dispute arose in the Swedish District Court between Norra and Nycander about the compensation due for the work as Nycander argued that the amount of time Norra spent on the work was not as much as Norra was claiming payment for.

As part of proving its argument, Nycander requested that Entral produce the staff register. Norra resisted this on the grounds that such a disclosure would breach the GDPR – the requested data was collected for tax purposes and so could not be utilised for the purposes of evidence in proceedings.

The Swedish Court of Appeal upheld the District Court’s order that Entral produce the register. Norra appealed to the Swedish Supreme Court asking that the court either (i) reject Nycander’s request for disclosure; or, alternatively (ii) order that an anonymised version be produced. The Supreme Court referred the matter to the CJEU for a preliminary ruling to clarify:

1. whether the national court can become a controller under the GDPR; and

2. whether the GDPR imposes requirements on national procedural legislation relating to the powers and obligations of courts in civil proceedings.

1. Is the national court a data controller?

The processing in issue was the disclosure by Entral of the staff register as evidence in the civil proceedings (and not the original processing that was collected for tax reasons). The question was whether the Swedish court, in determining the purpose and means of that evidence’s processing, became a data controller.

Advocate General Ćapeta (the AG) clarified that the national court can become a controller as, under Article 2(1) GDPR, it is the what rather than the who that triggers the GDPR. All bodies are subject to the GDPR except for the Union institutions and agencies (Article 2(3)). Judicial activities in civil procedures do not fall within that exception. Further, Recital 20 GDPR confirms its obligations apply to the activities of courts and other judicial authorities.

2. Does the GDPR impose requirements on national courts during disclosure proceedings?

Article 6(3) GDPR requires that data processing taking place in the exercise of official authority be based on EU or member state law. The legal basis for adopting the order for disclosure was provided for by the Swedish Code of Judicial Procedure (the RB). However, the CJEU held that the RB did not go far enough to comply with the GDPR, as it did not require, the Swedish courts to consider the interests of data subjects.

The AG held that national procedural legislation cannot prevent the interests of data subjects being taken into consideration (as that would mean overruling the GDPR which members states cannot do). At the very least, national legislation should allow national courts to apply the GDPR in a complementary way, as those courts are obliged to do.

Where ruling on disclosure of any documentary evidence involving personal data, the AG suggested that the default starting position for national courts should be to undertake a ‘proportionality analysis’ that weighs up the interests of the data subjects against the parties to the case’s interest in the evidence being disclosed.

The Court should look to principles set out in Article 5 GDPR to guide this analysis and the balancing act it involves. Particularly relevant is the principle of data minimisation, such that courts should consider whether the disclosure of personal data as evidence is “adequate, relevant and limited to what is necessary for the purposes for which they are processed” and if there are ways to de-personalise the data.

Analysis

This case was a preliminary ruling so there is no guarantee that the opinion of the AG will be followed either in a final ruling or that national courts will observe it in the interim. However, as AGs’ rulings tend to be persuasive, we may see the national courts of members states assuming this approach to disclosure.

If national courts do assume this approach, it may lead to (1) more personal data being pseudonymised or anonymised in legal proceedings; or (2) parties to civil proceedings producing more restricted disclosure with the excuse of interference with the rights of data subjects mentioned in the documentation.

The CJEU's decision in this case is at slight odds with the decision made by a Scottish Sheriff Court in Riley v Student Housing Company (Ops) Ltd [2023] SC DNF 7 (to read more, please see our article here). In Riley, the court held that the disclosing party was exempted from the UK GDPR provisions as litigating parties’ right to conduct litigation freely and fairly would be restricted if they also had to pay heed to the interests of the data subjects..

It is notable that Norra was decided four months before Riley and may mark the beginnings of divergence between EU and UK data protection laws post-Brexit. However, as both an AG’s opinion and a Scottish decision are not binding on the wider EU and UK respectively, it remains to be seen if the decisions (and divergence) are followed by the national courts of Member States or by the wider UK.