EU—Court of Justice clarifies when courts may rely on unlawfully obtained personal data as evidence

The CJEU held, in essence, that the GDPR does not impose an absolute prohibition on courts using unlawfully obtained personal data as evidence—the right to a fair trial justifies such processing, provided clear and foreseeable national rules (including case law) govern when and how such evidence may be admitted. The key points are as follows:

• A court may rely on evidence containing personal data that a party obtained unlawfully, even where that party's own interest in obtaining or using the data would not, by itself, outweigh the data subject’s privacy interests.
• National rules need not expressly state the circumstances under which a court may use personal data as evidence, provided clear, precise and foreseeable national case law establishes the relevant conditions.
• Article 17(3)(e) GDPR does not itself provide a standalone legal basis for processing personal data in litigation; it only limits the right to erasure where the data is needed to establish, exercise or defend legal claims. 
• Before disclosing such data to the parties (or third parties), the court must limit disclosure to what is necessary for the purpose concerned and, where appropriate, take measures (such as anonymisation) to mitigate the impact on data protection rights.
• A failure to meet the Article 13 GDPR transparency obligations does not, by itself, prevent a court from using that data in its judicial capacity. 
• The court must comply with the GDPR when handling personal data relating not only to the parties but also to third parties referred to in the proceedings. 

The judgment is available here.