Disclosure in a dispute entails an obligation to disclose information that can serve as evidence for a court. GDPR sets fundamental requirements to ensure the privacy of data subjects. When disclosure is requested by a party in a dispute regarding information that contains personal data, the rights of data subjects can be compromised. On Thursday, 2 March 2023, an important ruling was handed down by the European Court of Justice, which provides guidance in conflicts of interest that arise between a party's right to be able to produce evidence and individuals' privacy.
By the lawyer Johanna Näslund, Managing Partner, Advokatfirman Lindahl Örebro
In brief, the case concerns a contract dispute, in which a party requested that evidence be submitted to the court in the form of so-called ID 06 data. ID 06 data shows times at which individual construction workers were present at a building site. Such information can be valuable in an evidence context in contractual disputes as it can prove whether, for example, ÄTA (alterations and additions) works have been carried out or not. The data is collected pursuant on the developer's obligation to keep a register of its workers in order to facilitate tax control, i.e. for an explicit purpose. The request regarding disclosure was met (put simply) by an objection from the counterparty that GDPR applies and that the information concerning individual construction workers would not be disclosed.
The disclosure rules in Swedish law stipulate that the court must seek a balance between the evidence's relevance and the counterparty's interest of not disclosing the information. That the content might be of a private nature, or that the data subjects' (the construction workers) interests must be taken into account, is not specified in the Swedish procedural rules regarding disclosure.
Not unexpectedly, the European Court of Justice observed that national courts must apply GDPR in ruling on the disclosure issue, as producing evidence in court that contains personal data is processing in the sense applied by GDPR.
Among other things, this means that there must be legal grounds for the processing. in this case, it was established that the processing can, for example, be necessary in order to perform a task of public interest or as an element in the personal data controller's exercise of public authority, in this case, the courts' judicial activities. The European Court of Justice stated that additional processing, i.e. processing for purposes other than that for which the information was collected, can be permissible provided that it is based on a member state's national law (e.g. the disclosure rules) and it constitutes a necessary and proportional measure in a democratic society to protect certain purposes (e.g. the right to bring evidence when there is such an interest). In the forthcoming proceedings, the HD has to consider whether it is actually possible to meet the objectives and find the balance required by the European Court of Justice. The European Court of Justice also stated that national courts should take the data subjects' rights into account in connection with the application of the disclosure rules in Swedish procedural law.
Conclusions
To sum up, the following conclusions can be drawn:
- GDPR applies in connection with disclosure of information that contains personal data
- A balance that includes the data subjects' interests must be performed alongside the consideration that the Swedish disclosure rules explicitly specify
- The balance must be sought in each individual case
- It can result in different outcomes, depending on which type of case it concerns and the circumstances in general in each individual case
- The balance must include whether the information requested is adequate and relevant to achieve the objective
Relevant issues to take into account in the balance might be:
- Can less interventionary evidence be used?
- Can only parts of the requested information be disclosed?
- Can measures be decided to reduce the violation of the data subjects' privacy?
- Can restriction of the public's opportunity to access the documents in the case be decided?
- Can the parties be ordered to not use the information for other purposes?
As is clear from the questions above, the judgement means that the tools that we can use as counsel have been expanded and refined. It provides opportunities for the privacy aspects to be highlighted and given the place they deserve in the judicial reviews.
The European Court of Justice's judgement in case C-268/21, 2 March 2023, (Supreme Court case Ö 1750-20)
