Erfurt: A quarrel that began when an employer logged into a former worker’s private online account has produced a Court of Justice judgment that reshapes the law on GDPR evidence. On 18 June, in NTH Haustechnik, the Court held that the General Data Protection Regulation does not automatically bar a national court from using personal data as evidence, even when someone gathered that data in breach of the rules.
The facts were mundane. An employer accessed a former employee’s private marketplace account, possibly unlawfully, to prove that the worker had sold company property. The referring judges asked Luxembourg whether a court could rely on such material once a data-protection breach had tainted it.
The Court declined to impose a blanket exclusionary rule. It reasoned that the right to an effective remedy and a fair trial, itself a fundamental right under the Charter, can justify using personal data as evidence, provided clear and foreseeable national rules govern when a court may admit it. Readers can follow the Court’s output through its press service.
The ruling matters because it refuses to treat data protection as a trump card. The Regulation, the Court signalled, governs the lawful handling of information; it does not rewrite criminal or civil procedure. National judges must now weigh the competing interests case by case, and legal analysts have already parsed the consequences for employers who gather digital evidence informally.
For employers and employees alike, the judgment injects realism into disputes where digital evidence, often gathered informally, sits at the centre. It does not license snooping, and a party that breaches the Regulation still faces the remedies and fines the data-protection regime provides. Courts simply gain room to admit the material where a fair trial demands it. The decision also nudges national lawmakers to spell out, in statute or settled case law, exactly when tainted evidence may enter a courtroom, so litigants can anticipate the result rather than gamble on a judge’s discretion. Data-protection authorities, for their part, keep every power to punish the underlying breach, so the ruling shifts the remedy rather than erasing it. Employers should not read the decision as a green light to snoop.
What the judgment prevents is the automatic collapse of a case simply because someone collected the evidence improperly. The wider message reads plainly: privacy and fair-trial rights must coexist, and national judges, within the limits the Court has now drawn, must be the ones who reconcile them.




