Personal data, which may have been obtained unlawfully, are not automatically inadmissible as evidence. The European Court of Justice clarified this in its judgment of June 18, 2026, in Case C-484/24. The proceedings centered on the question of whether a court may take into account evidence that personal data included, even though this data may have been provided by a party to the proceedings under Infringement against the GDPR were obtained. The ECJ’s ruling is of great practical significance: A data protection violation does not necessarily result in the exclusion of evidence. Rather, the decisive factor is that the court’s Processing the processing of the data is based on its own legal basis, takes place within a sufficiently predictable procedural framework, and complies with the requirements of the GDPR be observed in legal proceedings.
Employer May Access Private eBay Account
The case stemmed from a labor law dispute. NTH Haustechnik GmbH sought damages from its former employee. The company accused her of selling items—which it claimed were the employer’s property—through a private eBay account. The claimed damages amounted to more than 46,000 euros.
However, it was not only the allegation itself that was controversial, but also the question of how the company had obtained this information. According to the referring court, the employer had learned of the sales by accessing the former employee’s private eBay account. Among other things, the browser history of a work computer and a password from a „Family folder“ on a Server played a role. The employee disputed this account and argued that the access to her private account had been unlawful.
The Lower Saxony Regional Labor Court did not definitively rule that the data collection was unlawful. However, it considered it possible that the employer had obtained the data unlawfully. That is precisely why it sought a ruling from the European Court of Justice (ECJ) on whether such data may nevertheless be used in labor court proceedings.
Does a GDPR violation automatically result in the exclusion of evidence?
The ECJ first clarifies that: The GDPR This generally applies to courts as well, provided that they personal data process. This may be the case, for example, when a court includes documents containing personal data in the case file, stores or analyzes digital evidence, or takes it into account in its decision-making.
At the same time, the ECJ clearly distinguishes between two levels. The first level concerns the initial collection of data by a party—in this case, the employer’s potentially unlawful access to the employee’s private eBay account. This collection of data may have been unlawful. The second level concerns the subsequent Processing by the court as part of the proceedings. This judicial Processing must be evaluated independently.
That is precisely the crux of the ruling: Even if a party personal data Even if data was obtained unlawfully, this does not automatically mean that the court is prohibited from using it. The court does not process the data because it approves of the prior collection of the data, but because, as part of its statutory duty, it must rule on facts, evidence, and claims.
No Automatic Prohibition on the Admission of Evidence
However, the decision should not be interpreted to mean that data obtained unlawfully is always admissible in court. The ECJ does not say that every piece of evidence obtained in violation of data protection laws must be used. Rather, it makes clear that the GDPR does not impose a general and automatic prohibition on the admission of evidence.
The admissibility and assessment of evidence are, in principle, matters governed by national procedural law. However, this procedural law must be compatible with Union law. For this reason, the Court of Justice of the European Union requires that there be a sufficiently clear, precise, and predictable framework setting forth the circumstances and conditions under which courts may admit evidence that personal data may be used. This framework may arise not only from written law but also from national case law, provided that it is clear, precise, and predictable.
This is particularly relevant for Germany because the ZPO does not contain explicit, detailed provisions for every conceivable category of unlawfully obtained personal data. The European Court of Justice (ECJ) does not consider this to be impermissible from the outset. However, it requires that national case law define the conditions for the judicial use of such evidence in a sufficiently predictable manner and, in doing so, pursue an objective in the public interest in a proportionate manner.
Legal Basis for Judicial Processing
The European Court of Justice upholds the Processing personal data in court proceedings, in particular Article 6(1), first subparagraph, letter c GDPR. Accordingly, a Processing lawful if it is necessary to fulfill a legal obligation. For courts, for example, such an obligation consists of ruling on the admissibility of evidence and evaluating admissible evidence in the decision-making process.
In doing so, the ECJ simultaneously rejects another line of reasoning. Art. 17, para. 3, subparagraph e GDPR does not constitute an independent legal basis for the Processing ... This provision merely stipulates that there is no right to have the entry deleted if the Processing is necessary to assert, exercise, or defend legal claims. However, this does not automatically mean that every such Processing is lawful. The actual review of legality therefore remains within the scope of Article 6 GDPR.
In practical terms, this means that anyone who, in court, personal data cannot simply claim, as a general rule, that the data is needed to defend legal rights. The decisive factor is whether the Processing is based on a sound legal basis in court and that the other data protection principles are observed.
Why Data Obtained Illegally May Still Be Usable
The ECJ bases its decision primarily on the right to a fair trial under Article 47 of the EU Charter of Fundamental Rights. According to this provision, parties to legal proceedings must, as a general rule, be able to effectively present and substantiate their claims or defenses. If every data protection violation were to automatically render evidence inadmissible, this could significantly impair effective legal protection.
Data protection law, therefore, does not stand in isolation from procedural law. It must be reconciled with other fundamental rights. While the right to the protection of personal data under Articles 7 and 8 of the Charter is important, it is not an unrestricted right. It may conflict with the right to judicial protection.
The ECJ is therefore not saying that data protection violations are irrelevant. Rather, it is saying that a data protection violation at the stage of obtaining evidence does not automatically mean that the court must disregard the evidence. The judicial Processing In fact, it pursues its own legitimate goal: conducting a fair trial and rendering an appropriate decision on the legal dispute.
No Free Pass for Illegal Data Collection
However, the ruling should not be misinterpreted as a free pass. Companies cannot conclude that they personal data may collect any information they wish, simply because it might be useful in court later on.
The ECJ makes a clear distinction between the potential unlawfulness of the initial data collection and the subsequent use of that data in court proceedings. Unlawful data collection may still have consequences. For example, claims for damages under Article 82 may arise GDPR, regulatory measures or fines under Article 83 GDPR. National courts may also continue to determine, on a case-by-case basis, whether there is a prohibition on the use of evidence under national law.
The decision therefore does not mean that data obtained unlawfully must always be used. It simply means that the GDPR does not impose a general and automatic prohibition on the admission of evidence.
Data minimization remains important throughout the process as well
Another key point of the ruling is that, when processing personal data, the court must continue to adhere to the principle of Data minimization Note: Pursuant to Article 5, paragraph 1, subparagraph (c) GDPR Only data that is appropriate, relevant, and necessary for the specific purpose may be processed.
However, the ECJ does not require courts to, in every single Processing in addition, conduct a comprehensive proportionality review. During the stage of determining whether evidence is admissible and relevant, the court may, in principle, process the data necessary for that purpose. However, once the court has declared the documents admissible and included them in the case file, or has disclosed them to the parties, third parties, or in a decision, it must assess whether the data is in fact needed to that extent.
This has practical implications. A court may personal data should not be disclosed without restriction or included in a decision simply because they are contained in a piece of evidence. Before disclosing such data to parties or third parties, it must be determined whether the data is actually necessary. If necessary, protective measures such as redactions, Anonymization or Pseudonymization into consideration.
This applies in particular when evidence also includes data from uninvolved third parties. In the case at hand, for example, data from eBay buyers might have been affected. The ECJ clarifies that courts must also adhere to the GDPR are bound.
The disclosure requirements under Article 13 of the GDPR do not automatically prevent the use of the data
The ECJ is also considering the question of whether a Infringement in violation of Art. 13 GDPR specified Duty to inform This means that a court is not permitted to use the data. Here, too, the answer is not so straightforward. If a party or a third party Duty to inform Failure to comply with data collection requirements may indeed constitute a data protection violation. However, this does not automatically prevent the court from using this data in the course of its judicial activities.
This point, too, is consistent with the general principle established in the ruling. Violations of data protection law during the initial collection of data do not automatically result in a procedural prohibition on the use of that data.
Implications of the ECJ Ruling for Employers
The ruling is particularly relevant for employers because many labor disputes are based on digital evidence: emails, browser histories, log files, instant messages, access logs, or platform data. The ruling provides greater legal certainty for cases in which such digital evidence personal data contained, and the collection of such data is controversial from a data protection perspective.
At the same time, it increases the pressure on companies to thoroughly document why data was collected, on what legal basis this was done, and why the Processing was required. Anyone who obtains evidence unlawfully continues to risk sanctions under data protection law and claims for damages. Furthermore, it remains to be seen whether national courts will rule that the evidence is inadmissible in a specific case for other reasons.
In practice, therefore, a two-step review is recommended: First, before collecting data, it must be determined whether the measure is permissible under data protection law. Second, during the process, it must be assessed which data is actually necessary and whether sensitive, excessive, or information irrelevant to the dispute can be redacted.
Source: ECJ Judgment C-484/24 (NTH Haustechnik) dated June 18, 2026
Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with in-depth expertise in Data protection, GDPRIT compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR compliance and risk management. You can find out more about him on his Author profile page.
German 
English 
Italian 
French