Norra Stockholm Bygg (Protection of personal data - Processing of personal data - Protection of judicial independence and judicial proceedings - Opinion) [2022] EUECJ C-268/21_O

1.

‘Your privacy is important for us. We use cookies to improve the user experience. Please review privacy preferences. Accept all / Settings. Check our privacy policy and cookies policy’. ( 2 )

2.

Upon visiting any website, a message of a similar kind will pop up.

3.

That is the result of the General Data Protection Regulation (‘the GDPR’), ( 3 ) which has become the main instrument for the protection of personal data in the European Union.

4.

Does the GDPR also pop up before national courts? More specifically, does it apply to disclosure obligations in a civil procedure before a national court? If it does, what obligations does it create for those courts? These are the issues that the Court is invited to clarify in this case.

5.

Those issues arose in a case before the referring court, the Högsta domstolen (Supreme Court, Sweden). The facts of the case can be summarised as follows. Norra Stockholm Bygg AB (‘Fastec’), the appellant in the main proceedings, carried out the construction of an office building for Per Nycander AB (‘Nycander’), the respondent in the main proceedings. The employees carrying out the work under that contract recorded their presence in an electronic staff register for tax purposes. The staff register was provided by Entral AB, acting on behalf of Fastec.

6.

The main proceedings began with a dispute concerning the compensation due for the work carried out. Nycander has challenged Fastec’s payment request (amounting to just over 2000000 Swedish kronor (SEK), approximately 190133 EUR), claiming that the amount of time that Fastec spent on the work was less than the period in respect of which Fastec is claiming payment.

7.

To prove that this is the case, Nycander requested that Entral produce the staff register it kept on behalf of Fastec. Fastec is opposing that request, claiming that such a disclosure would breach the GDPR, as the requested data were collected for another purpose and cannot be used as evidence in the main proceedings.

8.

The Tingsrätt (District Court, Sweden) ordered Entral to produce the register, and this decision was upheld on appeal by the Svea hovrätt (Svea Court of Appeal, Stockholm, Sweden).

9.

Fastec appealed against the decision of the Svea hovrätt (Svea Court of Appeal, Stockholm) before of the Högsta domstolen (Supreme Court), and asked that court to reject Nycander’s request for disclosure or, in the alternative, to order that an anonymised version of the staff register be produced. It is in the context of that procedure that the Högsta domstolen (Supreme Court) submitted a request for a preliminary ruling to the Court of Justice with the following questions:

10.

In the course of the proceedings, written observations were submitted to the Court by Fastec, the Czech, Polish, and Swedish Governments and the European Commission. A hearing was held on 27 June 2022 where Nycander, the Polish and Swedish Governments, and the Commission presented oral argument.

11.

Article 5 of the GDPR determines the principles that any processing of personal data must comply with:

‘1.   Personal data shall be:

2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’

12.

Article 6 of the GDPR, entitled ‘Lawfulness of processing’, in its paragraphs 1, 3 and 4 provide as follows:

‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:

…

…

…

3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

4.   Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

13.

Furthermore, Article 23(1) of the GDPR regulates restrictions of rights and obligations under the GDPR:

‘1.   Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

…

…’

14.

The first subparagraph of Paragraph 2 of Chapter 38, of the rättegångsbalken (Code of Judicial Procedure; ‘the RB’) provides that any person in possession of a written document which may be deemed to have probative value is required to produce that document. The second subparagraph of the same provision sets out exceptions to such an obligation, including lawyers, doctors, psychologists, priests and other officials who have been entrusted with information while carrying out their profession or equivalent. Paragraph 4 of Chapter 38 of the RB then grants a court the power to order the disclosure of a written document as evidence.

15.

According to the referring court, when considering whether a person should be obliged to produce a document, a court must weigh up the relevance of the evidence against the opposing party’s interest in not releasing that information. However, as the referring court explains, this does not involve taking into account the private nature of the information being disclosed.

16.

The GDPR is the main EU act regulating the protection of natural persons regarding the processing of their personal data. Unlike its predecessor, Directive 95/46/EC, ( 4 ) the GDPR was adopted on the basis of Article 16 TFEU. ( 5 ) That legal basis empowered the EU legislature to safeguard the fundamental right to protection of personal data, provided for in Article 8(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’). ( 6 )

17.

When personal data are processed, the GDPR places the responsibility for compliance with that act on the ‘data controller’. ( 7 ) In every instance of personal data processing, it is, therefore, important to establish who the data controller is.

18.

In accordance with Article 4(7) of the GDPR, the data controller is the natural or legal person, public authority, agency or other body, which determines the purposes and means of the processing of personal data.

19.

In the case at hand, two separate instances of processing of personal data took place. The first processing concerns the electronic staff register maintained by Entral on behalf of Fastec, the latter being under an obligation, envisaged by Swedish law, to collect data on hours worked for tax purposes. In this context, Fastec is the controller and Entral is the processor. ( 8 )

20.

It is not disputed that this first processing was in compliance with the GDPR. Specifically, Article 6(1)(c) thereof allows processing of personal data necessary for compliance with a legal obligation to which the controller, in this case Fastec, is subject. ( 9 ) Certainly, if this first processing were to be found unlawful under the GDPR, the repurposed processing of such data would, by extension, be unlawful as well. ( 10 )

21.

The interest of this case is, however, the second (repurposed) processing of the same data that was originally collected for tax purposes. The new purpose is the disclosure, by Entral, of the staff register as evidence in the civil proceedings between Fastec and Nycander. Producing that register for its use in civil proceedings would necessarily entail processing of personal data.

22.

In that second processing, the roles under the GDPR change in comparison to the first processing. Most importantly, by issuing the order to Entral to produce the staff register (‘the order for disclosure’), the national court is the entity determining the purposes and means of the second data processing. ( 11 ) That court, therefore, becomes the data controller. ( 12 )

23.

In that second processing, Fastec might be seen as remaining the controller, or having changed role: now being the recipient of data, together with Nycander. ( 13 ) However, even if Fastec remains the controller jointly with the national court, ( 14 ) that would not influence the obligations of the national court as controller. ( 15 ) Finally, the role of Entral does not change. It remains the processor and continues to process the same personal data, but now on behalf of the new controller, the national court.

24.

By its first question, the referring court asks essentially whether the national court can indeed become a controller under the GDPR, and whether, in that case, that regulation imposes requirements on national procedural legislation relating to the powers and obligations of courts in civil proceedings. If the GDPR applies and the national court is the controller, the referring court asks, in its second question, how such a court should decide on the disclosure of personal data when they are to be used as evidence in civil proceedings.

25.

To answer the questions of the referring court, I will proceed as follows. I will first explain why I consider the GDPR applicable to civil proceedings before Member States’ courts and how that influences the Member States’ existing procedural legislation (B). Thereafter, I will deal with the methodology which national courts as data controllers should apply to satisfy the requirements of the GDPR (C).

26.

The first question of the referring court asks essentially whether the GDPR applies to civil judicial proceedings and what influence it has on the pertinent procedural rules. More specifically, it questions whether it affects those national rules that govern the powers and obligations of courts in ordering the disclosure of documentary evidence. I will answer this question in three steps.

27.

The material scope of the GDPR is defined in Article 2(1) thereof and takes a functional, rather than an institutional approach. It is the what (the activity of processing of personal data) rather than the who, that triggers the applicability of the GDPR. ( 16 )

28.

Situations excluded from the scope of the GDPR, enumerated in Article 2(2) thereof, are likewise functional in nature. Given that they represent the exception to the application of the GDPR, the Court considered that they should be interpreted restrictively. ( 17 )

29.

The activities of public authorities are therefore not excluded from the scope of the GDPR as such, but rather solely in relation to the activities enumerated in Article 2(2) of the GDPR. ( 18 ) In that respect, that provision does not exclude judicial activities in civil procedures from the material scope of the GDPR.

30.

The conclusion that the GDPR applies to judicial activities is corroborated by recital 20 of the GDPR, ( 19 ) which states that that act applies to the activities of courts and other judicial authorities. ( 20 )

31.

The exclusion of the competence of supervisory authorities over courts when they act in their judicial capacity, set out in Article 55(3) of the GDPR, does not affect the previous conclusion. Quite to the contrary, to my mind, that provision confirms that courts acting in their judicial capacity are subject to the obligations imposed by the GDPR. It safeguards their independence and impartiality by prohibiting oversight by a supervisory body of their processing operations.

32.

The present case involves the processing of personal data, which falls within the material scope of the GDPR. The creation and maintenance of the electronic staff register concerns the processing of personal data. ( 21 ) Likewise, ordering the disclosure of such personal data in the context of civil proceedings is an instance of processing this data. ( 22 ) Thus, the situation in the main proceedings is within the material scope of the GDPR.

33.

What does that mean for the operation of national procedural rules, such as the RB?

34.

The legal basis for adopting the order for disclosure at issue in the present case is the RB.

35.

The GDPR indeed requires that data processing in a situation such as the one in the present case has Member State (or EU) law as its legal basis. ( 23 )

36.

Originally collected and processed for tax purposes, under the order for disclosure in the present case, the data at issue are now to be processed for a probative purpose in judicial proceedings.

37.

Article 6(4) of the GDPR allows for the repurposing of data processing if based on Member State law, which is a necessary measure in a democratic society to safeguard the objectives referred to in Article 23(1) of the GDPR. Among these objectives, Article 23(1)(f) lists ‘the protection of judicial independence and judicial proceedings’.

38.

All of the participants to this preliminary reference procedure agree that Article 23(1)(f) of the GDPR is the proper provision to rely on to justify the repurposing of data processing on the basis of the RB. ( 24 )

39.

The RB empowers national courts to order the disclosure of documents if they have probative value in a civil procedure. As explained, if a document to be disclosed contains personal data, the court ordering such a disclosure becomes the data controller under the GDPR.

40.

As the Commission pointed out at the hearing, the national court is only to a certain extent an ordinary controller. Namely, national courts can only process data in the exercise of their official authority.

41.

When data processing takes place in the exercise of official authority, ( 25 ) Article 6(3) of the GDPR requires it to be based on EU or Member State law.

42.

Therefore, both Article 6(4) of the GDPR (allowing for repurposed processing), and Article 6(3) thereof (allowing the processing of data in the exercise of official authority), require the existence of national (or EU) law as the legal basis for processing. ( 26 )

43.

The RB empowering the court to adopt the order for disclosure is, thus, a necessary condition for the lawfulness of the processing at issue.

44.

If the legal basis required by the GDPR exists, and the order which entails the processing of personal data is adopted in conformity with such Member State law, are the GDPR requirements for lawful processing satisfied?

45.

In my view, the existence of a legal basis in national law, although necessary, is not sufficient for the order for disclosure to be in conformity with the GDPR.

46.

The referring court explained that under the RB, in principle no account is taken of the private nature of information when making decisions about the disclosure of evidence. Courts are required to take into consideration the interests of the two opposing parties, but the law itself does not mention that the interests of data subjects play any role.

47.

Is the RB incompatible with the GDPR for not explicitly obliging courts, when they become data controllers, to take the interests of data subjects into consideration when enacting decisions that may influence their personal data?

48.

In my opinion, that is not the case. One must take into consideration that different national acts serving as legal bases for data processing were not adopted specifically in the implementation of the GDPR, but have their own purposes. Moreover, the GDPR is directly applicable in Member States’ legal orders and does not require implementation. What is therefore important is that when national procedural rules and the GDPR meet, the former provides space for a simultaneous application of the latter.

49.

At the hearing, the Swedish Government confirmed that the RB does not require, but it also does not prohibit, the courts from taking the interests of data subjects into consideration. It therefore does not preclude the direct application of the GDPR to the judicial procedure governed by that code.

50.

National courts are therefore subject to domestic procedural rules and the GDPR in parallel, the latter complementing national rules if the procedural activities of the courts entail the processing of personal data.

51.

To conclude, national legislation need not expressly refer to the GDPR or oblige courts to take into consideration the interests of data subjects. It suffices that such legislation allows for a complementary application of the GDPR. It is only if that were not the case that the national act would be contrary to the GDPR. The RB, however, seems to allow for a complementary application of the GDPR. ( 27 )

52.

In answering the first question of the referring court, I therefore conclude that Article 6(3) and (4) of the GDPR imposes requirements on national procedural legislation relating to disclosure obligations, whenever this entails the processing of personal data. National procedural legislation cannot prevent, in such a case, that the interests of the data subjects be taken into consideration. Those interests will be safeguarded if national courts respect the rules of the GDPR when deciding on the disclosure of documentary evidence in an individual case.

53.

As subjects of the GDPR, national courts as data controllers must take into consideration the interests of data subjects. How should those interests be taken into consideration when adopting a concrete decision concerning disclosure? That is the essence of the second question of the referring court.

54.

The interests of data subjects will be protected when the processing of their personal data complies with Articles 5 and 6 of the GDPR. ( 28 ) To quote Advocate General Pikamäe, compliance with Articles 5 and 6 of the GDPR ensures the protection of the right to private and family life and the protection of personal data, as guaranteed by Articles 7 and 8 of the Charter, respectively. ( 29 )

55.

The legitimate aims of processing are listed in Article 6 of the GDPR. ( 30 ) As explained in the previous section of this Opinion, the processing in the case at hand pursues a lawful purpose, given that the court exercised its official authority when ordering disclosure based on the national law that serves to ensure the orderly conduct of judicial proceedings. However, both Article 6, as well as Article 5 of the GDPR, require not only a legitimate aim, but also that the specific processing is necessary for achieving that aim.

56.

The GDPR therefore requires that the court undertake a proportionality analysis when determining whether the disclosure of personal data in a concrete situation is necessary for the probative purpose in judicial proceedings. ( 31 )

57.

In that respect, Article 6(4) of the GDPR requires that the national law on which the repurposed processing is based be a necessary and proportionate measure to safeguard one of the objectives listed in Article 23(1) of the GDPR, in this case the protection of judicial independence and judicial proceedings. Further, Article 6(3) of the GDPR requires that processing in the exercise of official authority be necessary for the exercise of such official authority vested in the controller.

58.

The national law which forms the basis for processing may in abstracto comply with the requirements of Article 6(3) and (4) of the GDPR. Still, the lawfulness of each individual processing (including a specific court order for disclosure) depends on the concrete balancing of all the interests involved, bearing in mind the legitimate aim for which disclosure is requested. ( 32 ) Only in such a way can the national court decide whether and to what extent the disclosure is necessary.

59.

It is thus clear that the GDPR requires a proportionality analysis. Is the GDPR of any further assistance in answering which concrete steps the court must take in such an analysis?

60.

The proportionality analysis, as explained, must be carried out in each individual case, taking into consideration all the interests involved. In situations such as the case at hand, the interests behind the disclosure must be weighed against the interference with the right to the protection of personal data. ( 33 )

61.

The interests behind disclosure reflect the right to effective judicial protection (Article 47 of the Charter). The interests of data subjects, with which the former right conflicts, reflect the right to private and family life (Article 7 of the Charter) and the right to protection of personal data (Article 8 of the Charter). It is these rights that need to be balanced in order to decide whether disclosure of personal data is necessary.

62.

In what follows, I will offer certain suggestions concerning the specific steps the national court may be expected to take.

63.

To begin with, it may always be presumed that data subjects who have not given their consent to the processing have an interest in restricting the processing of their personal data. That is thus the default starting position for the national court: to justify why this interest should be interfered with.

64.

In my view, instructions for carrying out this assessment may be found in Article 5 of the GDPR, containing the principles that the data controller must respect when processing personal data.

65.

In that respect, the data minimisation principle, from Article 5(1)(c) of the GDPR, is of cardinal importance. That requirement is, as stated by the Court, ( 34 ) an expression of proportionality. It requires that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

66.

The first question to ask is, therefore, whether the data in the staff register held by Entral are adequate. They will be adequate for the purpose for which they are to be disclosed if they indeed show the number of working hours spent by the Fastec employees on the construction site.

67.

The second question is whether the data in the staff register held by Entral are relevant for the purpose for which they are requested. The purpose seems to be the interest of Nycander to prove its argument that Fastec employees worked for fewer hours than what is stated on the invoice. In such circumstances, the staff register would be relevant if it can indeed prove or disprove such a claim. The national court must assess its relevance in the light of other facts of the case (for example, the claim by Fastec that the staff register contains only a portion of the relevant working hours, others being spent outside the construction site).

68.

In order to respond to the third requirement of data minimisation, the national court must determine whether all or only some of the data contained in the register are sufficient for probative purposes. In addition, if there are other ways to demonstrate the same fact, data minimisation requires that those other ways be used. For example, the national court might need to assess the claim by Fastec that the actual hours worked may be verified by reference to documents that already form part of the case file before the referring court. If it finds that claim to be true, the national court cannot order the disclosure of personal data in the staff register.

69.

The national court needs to establish what types of personal data from the register are sufficient to prove or disprove the relevant facts. In that respect, the data minimisation principle requires that only data that are strictly necessary for the purpose in question be disclosed. It might therefore be necessary that Entral, as the processor, modifies the staff register in such a way that it limits the personal data to the necessary minimum, while allowing a conclusion to be drawn on the actual hours worked.

70.

In that respect, the national court must determine whether it is necessary that persons whose data are in the register are identifiable for the disclosure to have probative value (for example, if it is necessary to name individual workers in order to invite them to stand as witnesses). Otherwise, it may be sufficient to have the information concerning the total number of hours spent on the construction site and/or the number of persons that worked those hours.

71.

Depending on the answers to the foregoing questions, the court may decide to ask for the disclosure of pseudonymised or anonymised data. ( 35 )

72.

Under recital 26 of the GDPR, data that have undergone pseudonymisation remain within the material scope of the GDPR. That is so because it remains possible to trace the identity of a person behind the pseudonym. The opposite is true for anonymised data, which are outside its scope. The manner of disclosure ultimately ordered by the national court will therefore also have an effect on the further applicability of the GDPR. ( 36 )

73.

Ultimately, it will be for the national court to determine the probative value of different versions of the staff register in order to decide what type of data minimisation, if any, is necessary for the sound completion of the judicial proceedings before it.

74.

Aside from the data minimisation principle in Article 5(1)(c) of the GDPR, other principles contained in Article 5 of the GDPR also bind the national court and are relevant for the method of adopting the order for disclosure.

75.

For example, Article 5(1)(a) of the GDPR, apart from referring to the principle of lawfulness (further elaborated in Article 6 thereof), also mentions the principle of transparency. To my mind, that principle demands that the national court clearly explains its decision to order the disclosure of personal data, by, inter alia, stating how it balanced the different interests and arguments of the parties relating to the disclosure.

76.

Proper reasoning in the order for disclosure also satisfies the requirement of Article 5(2) of the GDPR, requiring that the data controller be able to demonstrate compliance with the principles stated in Article 5(1) thereof.

77.

The manner of compliance with the principles of Article 5 of the GDPR can also be read from recital 31 of the GDPR. It requires that ‘requests for disclosure sent by the public authorities should always be in writing, reasoned and occasional and should not concern the entirety of a filing system or lead to the interconnection of filing systems’.

78.

A concern relating to the proportionality assessment by the national court has been raised by the Polish Government: if the national court is to assess the probative value of the staff register or another piece of evidence in the proceedings before it, is it not already becoming too involved in what should remain the role of the parties, namely, attempting to win an argument concerning the very probative value of such evidence?

79.

In my view, the assessment of the probative value, which takes into consideration the interests of data subjects, does not lead to more interference with the case than the assessment of probative value of any other evidence in civil proceedings. ( 37 )

80.

The level of the national court’s interference will depend on the obviousness of the probative value of the data whose disclosure is being requested in the circumstances of the individual case. It will always pertain to the individual case to what extent the disclosure might interfere with the interests of data subjects.

81.

For example, some cases may involve sensitive data with a special protection regime under Article 9 of the GDPR, or criminal sanctions data pertaining to the regime of Article 10 thereof. In such situations, the interests of data subjects will necessarily gain more weight in the balancing exercise. ( 38 ) Likewise, the interest in disclosure may differ across individual cases. While at times it will be clear that the relevance of the requested evidence is marginal, in other situations it will be central to the determination of the outcome of the case. In that respect, there is value to the Commission’s point that the national court should enjoy broad discretion when making such assessments. Yet, it should never be relieved of the obligation to take into account the interests of data subjects.

82.

The Czech Government voiced another concern: imposing obligations on national courts to take into consideration the interests of data subjects whenever they are ordering the disclosure of documentary evidence would hinder the regular operation of judicial proceedings. The GDPR indeed introduces an additional obligation ( 39 ) for courts to undertake the proportionality review before ordering disclosure of documentary evidence containing personal data. However, neither is the balancing of interests an unusual intellectual exercise for the courts to undertake, nor is the burden placed on national courts different from the one imposed on any data controller by the GDPR.

83.

If the Union citizens are to enjoy a high level of protection of their personal data, consistent with the choice of the EU legislature as expressed in the GDPR, taking into consideration the interests of data subjects cannot be seen as an excessive burden placed on the Member States’ courts.

84.

I therefore propose that the Court answer the second question of the referring court as follows: when deciding on the order for disclosure in civil proceedings that entails the processing of personal data, the national court must undertake a proportionality analysis that takes into account the interests of data subjects whose personal data are to be processed and balance them in relation to the interest of the parties to the procedure to obtain evidence. That proportionality assessment is guided by the principles set out in Article 5 of the GDPR, including the principle of data minimisation.

85.

In the light of the foregoing considerations, I propose that the Court answer the two questions referred for a preliminary ruling by the Högsta domstolen (Supreme Court, Sweden) as follows: