The European Court of Justice (ECJ) has clarified that a data protection breach during the collection of personal data does not automatically render that data inadmissible as evidence in court.
The case arose from a dispute before an employment tribunal. An employer sought damages from a former employee on the grounds that the employee had allegedly sold company goods for her own profit via her private account on an online sales platform.
The employer had obtained the relevant information by gaining access to the employee’s private sales account using her username and password. The source of the login details was disputed between the parties.
The referring court submitted a comprehensive list of questions to the ECJ. Essentially, the issue was whether, and under what conditions, courts may admit data obtained unlawfully as evidence – and whether German procedural law provides a sufficiently specific legal basis for this at all.
It is widely assumed that information obtained unlawfully is, from the outset, of no value in court. However, under EU law, this ‘fruit of the poisonous tree’ doctrine – which originates from US criminal procedure law – has no basis. The ECJ makes it clear that personal data may not be excluded from use in court solely on the grounds that its collection may have infringed the GDPR.
In this regard, the Court expressly distinguishes between the lawfulness of the original data collection and the subsequent processing of that data by the court. Even if the collection was unlawful under data protection law, the court’s processing of the data must be assessed on its own merits. It is necessary to enable the court to fulfil its obligation to rule on the evidence offered by the parties and to ensure a fair trial.
Firstly, the ECJ states that the GDPR also applies to courts. However, their activities are only covered to the extent that the processing is carried out wholly or partly by automated means or the data are stored or are intended to be stored in a filing system – for example, where digitally transmitted documents are added to the case file or data are extracted from them. It is for the national court to determine whether this is the case.
In the CJEU’s view, neither the principles governing the processing of personal data nor the rights of the data subject generally and absolutely preclude a body such as a court from taking into account data that has previously been processed unlawfully. The Regulation does not contain a general prohibition on the use of unlawfully obtained personal data as evidence.
At the same time, the Court emphasises that data protection is not an absolute right. It must be balanced against other fundamental rights, in particular the right to effective judicial protection and to a fair trial.
Regarding the legal basis for judicial processing, the Court clarifies that the exception to the right to erasure for data necessary for the establishment, exercise or defence of legal claims cannot itself be relied upon as a legal basis. Rather, judicial processing is based on the court’s obligation to rule on the evidence offered by the parties and to assess admissible evidence.
The Court does not take issue with the fact that German procedural law contains no explicit provisions specifying the circumstances under which personal data may be used. Established case-law may also suffice as a legal basis, provided that it is clear, precise and foreseeable for those subject to the law, pursues an objective in the public interest and is proportionate. It is for the referring court to determine whether such case-law exists.
The Court does not require the party bearing the burden of proof to have a legitimate interest going beyond a mere interest in evidence. Even if that party has not informed the data subject of the processing – as is usually the case with covert data collection – this does not preclude the use of the data in court proceedings.
The use of such data in court proceedings is limited by the principle of data minimisation – though not in the form of a separate proportionality test for each individual processing operation. It is sufficient that the data used are appropriate and relevant to the purpose and limited to what is strictly necessary. Only before the court discloses the data to the parties or third parties – for example, upon service or publication of the decision – must it assess whether the impact can be limited, for instance through anonymisation or pseudonymisation.
The court is also bound by the GDPR with regard to personal data of third parties not involved in the proceedings. However, EU law does not require a party to be able to rely on infringements committed against third parties; this is left to national law.
The decision is of particular practical significance for internal investigations, compliance matters and employment law proceedings. It reduces the risk that a potential data protection breach during data collection could call into question the admissibility of the findings in court proceedings from the outset.
The focus thus shifts from the origin of the data to its processing. Anyone introducing findings from an internal investigation into proceedings should limit their submission to the information that is actually decisive for the dispute and exclude any unnecessary data – such as that relating to customers, business partners or other employees. There is, however, no need to demonstrate any further interest in the use of such data.
The ECJ draws a clear distinction between unlawfulness under data protection law and admissibility in legal proceedings. The judgement is therefore not a carte blanche for investigative measures that breach data protection law. Anyone who gains access to employees’ private accounts continues to risk fines, claims for damages and regulatory measures – and, under certain circumstances, criminal liability, for example for data spying. However, as regards admissibility in court proceedings, the following applies: under EU law, a tree tainted by data protection law does not necessarily bear inadmissible fruit.
(ECJ, judgment of 18 June 2026 – C-484/24, NTH Haustechnik)
Subscribe to our GvW Newsletter here - and we will keep you informed about the latest legal developments!
