An interesting verdict was reached by Advocate General (“AG”) Ćapeta in the case of Norra Stockholm Bygg AB v Per Nycander AB, joined parties: Entral AB (Case C‑268/21) EU:C:2022:755 earlier this month.

What happened?

The case considered how GDPR would apply where a court order was made as part of civil proceedings for disclosure of a staff register. GDPR states that it applies to “the processing of personal data by courts and other judicial authorities”, and AG Ćapeta set out his view that the national courts of EU member states were bound by both GDPR and their domestic procedural frameworks.

In this case, whilst the disclosure was in keeping with the local procedural rules (the Swedish Code of Judicial Procedure), GDPR also required that the interests of data subjects be taken into account and so compliance only with procedural rules was insufficient. 

The AG also said that national frameworks could not prevent such interests from being considered, as they could not overrule GDPR, and therefore member state courts needed to follow GDPR rules where ruling on disclosure of any documentary evidence involving personal data. 

In doing so, they should undertake a “proportionality analysis” that considers data subjects’ interests and balances them against the interests of relevant parties, and this should accord with the personal data processing principles set out in Article 5 GDPR, particularly data minimisation (that personal data should be “adequate, relevant and limited to what is necessary in relation to the purposes for which [it is] processed”).

Key takeaways

This case was a preliminary ruling and there is of course no guarantee that the opinion of AG Ćapeta will be followed in the final ruling (or that national courts will act in accordance with it in the meantime). 

However, with AGs’ rulings generally being persuasive, we may well see the courts of member states adopting an approach to disclosure which considers more strongly the need to comply with data protection laws, which may well lead to more restricted disclosure in practice than previously. 

And although any final judgment would not be binding on a post-Brexit UK, it may well have an advisory impact upon British court procedures as well, with potential for courts to interpret the Civil Procedure Rules and UK GDPR along the same lines. 

Although likely a bit too early to say for certain (the ruling only being just over a week old), it would be worth watching out, both in the EU and UK, for how courts may react (or not react) to the ruling over the coming weeks and months.