May courts use unlawfully obtained data?

The case

A heating and air-conditioning company employed a woman who was at the same time in a relationship with the company's managing director. After the relationship ended, the company established that she had sold company goods worth over 13,000 euros on her own account via the online platform eBay, and sued her for damages. The company learned of the sales by gaining access to the defendant's private eBay account — among other things, by the managing director reporting a mobile phone registered to the company as lost in order to reset the account password via a new SIM card. The Regional Labour Court (Landesarbeitsgericht) of Lower Saxony considered this data collection to be possibly unlawful and referred to the CJEU (EuGH) the question of whether it may nevertheless use the evidence thus obtained.

The CJEU's decision

The CJEU answered this in the affirmative in principle (judgment of 18.6.2026 – C-484/24, NTH Haustechnik). Under Art. 6(1)(c) GDPR, a court is entitled to process personal data from evidence submitted in order to decide on its admissibility and, if it is admissible, to take it into account in its decision — this obligation serves the right to a fair trial enshrined in the Charter of Fundamental Rights and is necessary for that purpose even if the party that submitted the evidence previously obtained it in breach of the right to data protection. What is decisive here is that this party itself does not pursue any interest in the processing beyond proving the facts put forward. Nor does a failure to comply with the duty to inform the data subject at the time of the original data collection in principle preclude its subsequent use in court.

Limits on use

However, the court is not entirely free in this respect: before disclosing the data concerned to the parties or third parties — for example in a judgment that is served or published — it must examine whether the data is limited to what is necessary for that purpose and, if necessary, take measures such as (partial) anonymisation in order to keep the interference with the rights of third parties as small as possible — for example where, as may be the case here, data of uninvolved buyers on the online platform is also affected. The CJEU also clarified that such a legal basis need not necessarily be contained in a formal statute: established, clear and foreseeable case law is sufficient, provided that it pursues an objective in the public interest and is proportionate.

What this means

For practice, the judgment means one thing above all: a data protection infringement in obtaining evidence does not automatically lead to a prohibition on its use in court — anyone wishing to rely in proceedings on digital traces such as chat histories, account or platform data therefore need not fear per se that this evidence will be disregarded because of its origin. However, this does not change the fact that accessing another person's online account itself — irrespective of its later usability in court — remains risky in terms of data protection law and, depending on the circumstances, also criminal law. Anyone wishing to secure evidence against a (former) employee or a contractual partner should therefore rely on lawful means rather than on subsequent usability in court.