Teisė ISSN 1392-1274 eISSN 2424-6050
2024, Vol. 131, pp. 102–112 DOI: https://doi.org/10.15388/Teise.2024.131.7
Jurgis Bartkus
Doctor of Social Sciences
Faculty of Law, Vilnius University
Teaching assistant at the Department of Private Law
Saulėtekio al.. 9, Building I , LT-10222 Vilnius, Lithuania
Phone: (+370 5) 236 6170
E-mail: jurgis.bartkus@tf.vu.lt
Jurgis Bartkus
Vilnius University, Lithuania
Summary. The article analyses the impact of the EU General Data Protection Regulation on the admissibility of evidence in Lithuanian civil procedure after the judgment of the Court of Justice of the European Union in case C-268/21. The article provides an overview of the requirements of the General Data Protection Regulation for civil proceedings and identifies specific problematic aspects that could unbalance the evidentiary system in Lithuanian civil proceedings.
Keywords: admissibility of evidence, data protection, GDPR, civil procedure.
Jurgis Bartkus
(Vilniaus universitetas (Lietuva))
Santrauka. Straipsnyje analizuojamas Europos Sąjungos bendrojo duomenų apsaugos reglamento poveikis įrodymų leistinumui Lietuvos civiliniame procese po Europos Sąjungos Teisingumo Teismo sprendimo byloje C-268/21. Apžvelgiami Bendrojo duomenų apsaugos reglamento reikalavimai civiliniam procesui ir nurodomi konkretūs probleminiai aspektai, galintys išbalansuoti įrodinėjimo sistemą Lietuvos civiliniame procese.
Pagrindiniai žodžiai: įrodymų leistinumas, duomenų apsauga, BDAR, civilinis procesas.
________
Received: 19/04/2024. Accepted: 29/04/2024
Copyright © 2024 Jurgis Bartkus. Published by Vilnius University Press
This is an Open Access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
The impact of the EU General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, 2016; hereinafter GDPR) on the legal frameworks of the EU Member States since its entry into force has been immense. Since the introduction of the GDPR, data protection standards have become increasingly high, and companies face the more and more complex task of evaluating whether their data processing activities are legally compliant. For a good reason, over the last couple of years, data have become a valuable asset and are even called the currency of the future (Voigt, von dem Bussche, 2017, p. 1).
The GDPR’s requirements affect not only private entities but also the public sector, including judicial proceedings in EU Member States. However, applying data protection law to the judiciary is a complex issue (Kuner et al., 2020, p. 909). On the one hand, the requirements of the GDPR are also relevant in court proceedings. The fundamental right to data protection fully applies when personal data are processed by judicial authorities, even when the personal data are included in judicial files in pending procedures (Kuner et al., 2020, p. 909).
On the other hand, the impact of the GDPR is limited. For example, judicial authorities acting in their capacity should not be subject to the control of data protection agencies. In addition, it has traditionally been recognised that one of the essential issues outside the scope of data protection law is the admissibility of evidence obtained in breach of data protection laws (Kuner et al., 2020, p. 910). In other words, the GDPR does not directly regulate or lay down specific rules on the admissibility of evidence in court proceedings.
The relationship between the requirements of the GDPR and court proceedings will inevitably change as a result of the landmark judgment of the Court of Justice of the European Union (hereinafter CJEU) delivered on 2 March 2023 in Case C-268/21 (hereinafter Judgment), which explains the application of the GDPR to the national rules of evidence of the EU Member States (Norra Stockholm Bygg…). As will be shown below, the main impact of this Judgment is on the rules regarding the admissibility of evidence. Accordingly, the main aim of this article is to reveal and assess the impact of the GDPR on the admissibility of evidence in Lithuanian civil procedure after the Judgment of the CJEU.
In order to achieve the above-mentioned aim, the following three objectives are set out, each of which is analysed in separate parts of the article: 1) to provide an overview of the interpretations of the GDPR arising from the CJEU’s Judgment; 2) to reveal how the CJEU’s Judgment will impact the admissibility of evidence in Lithuanian civil proceedings; and 3) to make critical observations regarding the impact of the CJEU’s Judgment and, consequently, the impact of the GDPR on the admissibility of evidence in Lithuanian civil procedure. The article seeks to identify the problems raised by the Judgment in the context of the admissibility of evidence. However, it does not seek to suggest how we might resolve these problems. Identifying the problems in the first place is important and valuable, while the solutions may be the subject of future research.
The object of the research is the impact of the GDPR on the admissibility of evidence in Lithuanian civil procedure after the Judgment of the CJEU. The article focuses exclusively on the consequences for the Lithuanian civil procedure and analyses a particular aspect of fact-finding in the Lithuanian civil procedure, i.e. the admissibility of evidence.
The research is grounded in the doctrinal method of legal research. It examines, compares, and critically evaluates three sources of law: 1) the legislation that deals with data protection and the admissibility of evidence; 2) the case law of CJEU, and 3) legal scholarship.
The relevance of the topic, the degree and the originality of the research lie in the fact that protecting personal data is one of the most essential areas of law in the 21st century. As this area increasingly influences the judicial process, it is necessary to analyse, uncover and critically assess the requirements of data protection law in the evidentiary process. The impact of the CJEU’s Judgment has not been analysed in Lithuanian legal scholarship. Hence, this research is original and new in the context of Lithuanian legal scholarship.
An overview of the sources and literature: the primary sources of positive law are the GDPR and the Civil Procedure Code of the Republic of Lithuania (Lietuvos Respublikos civilinio proceso kodeksas, 2002; hereinafter CPC). This research is also substantially influenced by the above-mentioned CJEU Judgment. Also, the works of legal scholars have played a significant role in this research. The article relies on the works of Vytautas Nekrošius, Alex Stein, Cass R. Sunstein and other authors.
The relationship between the GDPR and the judicial process is a complex issue. At least until the CJEU’s Judgment, the position was that the GDPR does not regulate the admissibility of evidence in the civil procedures of the EU Member States (Kuner et al., 2020, p. 909).
As will be shown below, the status quo has been altered by the CJEU’s Judgment by which the CJEU answered two preliminary questions from the Supreme Court of Sweden. The Swedish Supreme Court’s reference was made in an employment dispute between Norra Stockholm Bygg AB (hereinafter Norra) and Per Nycander AB (hereinafter Nycander) concerning Nycander’s request for the submission of evidence, i.e. an electronic timesheet of Norra’s employees’ time records for the work performed for Nycander. This timesheet was held by Entral AB, acting on behalf of Norra.
In support of its request for evidence, i.e. the timesheet, Nycander submitted that Entral had the timesheet and that the timesheet could be relevant evidence in determining Norra’s claim, as the data recorded in the timesheet would enable it to prove the hours worked by Norra’s employees. Norra objected to this request and argued that the request was contrary to Article 5(1)(b) of the GDPR, which provides: “Personal data shall be: collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes [...]” (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ L 119). Norra’s timesheets allegedly contain personal data collected to enable the Swedish tax authorities to monitor the company’s activities, and disclosure of such data in court would not align with the purpose for which these data were collected.
Both the court of first instance and the court of appeal granted Nycander’s request and requested evidence from Entral AB. When the case came before the Swedish Supreme Court, the Court was confronted with the question of whether and how to apply the GDPR in this particular situation. Accordingly, the Swedish Supreme Court referred two following questions to the CJEU:
1) Does Article 6(3) and (4) of the GDPR also impose a requirement on national procedural legislation relating to the obligation to produce documents?
2) If Question 1 is answered in the affirmative, does the GDPR require consideration of the interests of the data subjects when a decision on (production) that involves the processing of personal data has to be made? In such circumstances, does EU law establish any detailed requirements regarding how that decision should be made?
The following parts set out the answers to the questions posed by the Swedish Supreme Court.
The CJEU answered the first question in the affirmative, stating that Article 6(3) and (4) of the GDPR must be interpreted as meaning that that provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection. The CJEU made the following five arguments:
Firstly, Article 2(1) of the GDPR provides that that regulation applies to any “processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system”, without any distinction being made whether the person who carried out the processing concerned is a private person or a public authority.
Secondly, Article 4(2) of the GDPR defines “processing” of personal data as including, inter alia, any operation performed by automated or non-automated means on personal data or on sets of personal data, such as collecting, recording, using, disclosing, transmitting, disseminating, or otherwise making available, personal data. This includes not only the creation and maintenance of an electronic timesheet but also the production as evidence of a digital or physical document containing such personal data where the court orders it to be produced during legal proceedings.
Thirdly, the CJEU noted that any processing of personal data, including processing by public authorities such as courts, must comply with the lawfulness conditions set out in Article 6 of the GDPR.
Fourthly, where personal data are processed for a purpose other than that for which they were collected, it follows from Article 6(4) of the GDPR, read in conjunction with recital 50 of the GDPR, that such processing is permitted, provided that it is based on the law of the Member State and that it constitutes a measure which is necessary and proportionate in a democratic society for the pursuit of one of the purposes referred to in Article 23(1) GDPR.1
The CJEU noted that the evidence submitted in the case, i.e. the timesheet, was gathered for tax control purposes following specific provisions of Swedish national law, which means that its processing during the proceedings is carried out for a different purpose than the one for which it was originally collected. In this context, the processing of personal data for a purpose other than that for which the data were collected must not only be based on national law but must also be a necessary and proportionate measure in a democratic society within the meaning of Article 6(4) of the GDPR, and must ensure one of the purposes referred to in Article 23(1) of the GDPR.
Fifthly, in the context of the production of evidence, some of the possible purposes of Article 23(1) of the GDPR are either the purpose of para. (f) of the GDPR, “the protection of judicial independence and judicial proceedings”, which is understood to encompass, among other things, the “good administration of justice”, or para. (j) of the GDPR, “the enforcement of civil law claims”.
In answer to the second question, the CJEU stated that Articles 5 and 6 of the GDPR must be interpreted as meaning that, when assessing whether the production of a document containing personal data must be ordered, the national court is required to have regard to the interests of the data subjects concerned and to balance them according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation referred to in Article 5(1)(c) of that GDPR. The CJEU presented the following five arguments:
Firstly, any processing of personal data, with the exceptions provided for in Article 23, must comply with the principles set out in Article 5 of the GDPR and satisfy the conditions of lawfulness set out in Article 6.
Secondly, national provisions governing the production of evidence in civil proceedings may be deemed lawful under Articles 6(3) and (4) of the GDPR in relation to Article 23(1)(f) and (j) of the GDPR. This is because, firstly, the national provisions aim to ensure the due course of legal proceedings by guaranteeing that the right holder can exercise his rights where there is a “legitimate interest in evidence”; secondly, national provisions can be necessary and proportionate to this objective.
Thirdly, to verify whether the requirements of necessity, proportionality and Article 23(1) of the GDPR are met, the national court must consider the existence of conflicting interests when assessing whether it is possible to order the production of a document containing personal data. The CJEU has indicated that the national court must take these interests into account:
1) the need to ensure the protection of natural persons while processing personal data;
2) the need to ensure the right to private life as enshrined in Article 7 of the Charter of Fundamental Rights of the European Union (Charter of Fundamental Rights of the European Union, 2012; hereinafter EU Charter), which is closely linked to the right to the protection of personal data;
3) the need to ensure the right to an effective judicial remedy enshrined in Article 47 of the EU Charter, which includes the right to have access to the evidence necessary to sufficiently prove the validity of their allegations, which may include data relating to the parties or third parties;
4) Article 5(1) of the GDPR, particularly the principle of “data minimisation” in para. (c) of this provision, which expresses the principle of proportionality. According to the principle of data minimisation, personal data must be adequate, relevant and only necessary for the purposes for which they are processed;
5) the need to establish that the disclosure of personal data is appropriate and relevant in order to achieve the objective pursued by the applicable provisions of national law, and whether that objective cannot be achieved by less restrictive means of proof, such as questioning witnesses, etc.
Fourthly, the CJEU has also outlined a number of exemplary measures that a national court should take to mitigate the restriction on the right to data protection. For example, in cases where only part of the data is necessary as evidence, the national court may use pseudonymisation of data subjects’ names, as defined in Article 4(5) GDPR.
Fifthly, the national court does not have to have access to the content of the requested evidence to be able to assess and weigh the above-mentioned conflicting interests properly. Otherwise, the disclosure of third parties’ data may lead the court to authorise the disclosure, in whole or in part, of personal data communicated to it by the other party.
Therefore, in response to the Swedish Supreme Court’s questions, the CJEU stated that a national court must take into account and make a specific assessment of the requirements of the GDPR when it receives a party’s request for the production of evidence containing personal data collected for purposes other than the purpose of establishing facts in legal proceedings.
Undoubtedly, the interpretations provided by the CJEU in its Judgment will significantly impact the Lithuanian civil procedure, particularly the admissibility of evidence. As evident from the CJEU’s interpretations reviewed above, the requirements arising from the GDPR also apply to the production of evidence in civil procedure.
Similarly to Swedish civil procedure, Lithuanian civil procedure governs the production of evidence. Article 199 of the CPC “Production of Written Evidence” regulates the production of evidence in civil proceedings. Paragraph 1 of this Article provides that the parties to the proceedings shall have the right to obtain written evidence not only from the persons participating in the proceedings but also from persons who are not participating in the proceedings. Paragraph 1 also lays down the information that must be included in the submission for the production of evidence: 1) the requested written evidence; 2) the grounds on which the person is presumed to be in possession of that evidence; 3) the factual circumstances which evidence may establish.
In what instances could the court refuse such a request for the production of evidence? This question can be answered by a more detailed analysis of Article 199 of the CPC and the whole evidentiary system of Lithuanian civil proceedings. The analysis allows us to distinguish the following conditions for granting the request:
1) the party has specifically identified the written evidence (Article 199(1) of the CPC);
2) the person from whom the evidence is sought, is in possession of the written evidence (Article 199(1) of the CPC);
3) the evidence is relevant to the facts of the civil proceedings (Article 177(1) of the CPC). The requirement of the relevance of evidence derives from the definition of evidence set out in Article 177 of the CPC: “Evidence in a civil case shall be any factual matter on the basis of which the court, acting in accordance with the procedure laid down by law, establishes the existence, or otherwise, of the matters supporting the parties’ respective claims and defences, and of any other matters relevant for the just determination of the case”;
4) the evidence is admissible, i.e. there is no rule of admissibility of evidence that excludes the evidence. For example, the content of the evidence is not protected by legal privilege (see Article 199(3) of the CPC), the evidence is not subject to procedural form restrictions (see, for example, Article 177(3) of the CPC), the evidence is lawfully obtained, etc. (Nekrošius, 2021; Bartkus, 2022).
The CJEU Judgment adds a critical condition for granting a request for the production of evidence, as it creates an additional requirement for the admissibility of evidence. The latter requirement is explained in more detail below:
Firstly, Article 6(3) and (4) of the GDPR apply to the request to produce evidence. These provisions would apply when 1) the requested evidence contains information that constitutes data of persons not involved in the case; 2) the data were collected for purposes other than those for which they are intended to be used.
It should be noted that, in the context of the production of evidence, the requested documents will, in practically all cases, be processed in court proceedings for a purpose other than that for which the data were originally collected. Hence, the requirements of the GDPR will be relevant in practically every case where a party to a civil proceeding requests the evidence.
Secondly, the national court faced with a request to produce evidence will have to weigh and assess the criteria identified in the Judgment. The national court will have to assess the requirements of necessity, proportionality, and the requirements stemming from Article 23(1) GDPR. The court will have to weigh the need to ensure the protection of natural persons in the processing of personal data, the need to ensure the right to an effective judicial remedy enshrined in Article 47 of the EU Charter, and the other aspects set out above.
In other words, the national court will have to apply the so-called balancing test, which can be described as the decision maker’s assessment and weighing of some relevant factors whose precise content has not been specified in advance (Sunstein, 1995, p. 963). In simpler terms, when using the balancing test, a judge’s decision on whether evidence is supposed to be admitted is not determined by a clear-cut legal rule. Instead, it is based on the judge‘s judgment, considering multiple factors specific to the case. An analysis of the CJEU’s Judgment suggests that national courts faced with requests for the production of evidence must assess up to seven different and wide-ranging criteria.
Accordingly, as can be seen, the CJEU’s Judgment establishes an additional admissibility rule, which may exclude a request to produce evidence on grounds relating to the protection of personal data. This rule obliges the national court to ascertain whether granting the request for the production of evidence would lead to a breach of the GDPR.
Moreover, the impact of the CJEU’s Judgment does not end with Article 199 of the CPC. For example, Article 160(1)(1) of the CPC establishes the power of the presiding judge to order the persons involved in the proceedings to produce the evidence in their possession before the court. The Judgment implies that, in exercising this power, the presiding judge will not only have to ascertain whether the evidence is relevant and whether it is not subject to the rules of admissibility arising from the CPC and other laws but will also have to take into account and balance the requirements arising from the GDPR.
Thus, as indicated above, the CJEU’s Judgment creates an additional requirement for the admissibility of evidence that constitutes personal data collected for purposes other than its use in legal proceedings. The national court will have to balance various requirements of the GDPR and other competing interests present in the civil proceedings to ascertain whether the evidence is admissible. Any admission of evidence in civil proceedings will, therefore, have to comply with the requirements of the GDPR.
Whether we like it or not, the CJEU’s Judgment and the GDPR will significantly impact the evidentiary system in civil proceedings. Litigants and courts will now have to deal with the rather complicated reality of data protection.
As mentioned in the introduction to this article, the research is not limited to an overview of the CJEU’s Judgment but also makes some critical observations that could shed light on the problematic aspects of this Judgment. The following observations reveal several problematic downsides that should have an impact on Lithuanian civil procedure:
Firstly, the CJEU Judgment and its requirements significantly complicate both the possibilities of obtaining evidence and, very importantly, the conditions for establishing the substantive truth in Lithuanian civil proceedings.
As mentioned above, one of the most important consequences of the CJEU Judgment is that an additional ground for the admissibility of evidence will be introduced in Lithuanian civil proceedings, i.e. the court will be obliged to refuse to grant a request for the production of evidence on the grounds of personal data protection.
The relationship between the rules of evidence limiting the production of evidence in proceedings and the administration of justice requires a careful and considerate balance. On the one hand, as the renowned scholar Bentham argues, “Evidence is the basis of justice”, and when you “exclude evidence, you exclude justice” (Bentham, 1827 quoted Stein, 2015, p. 469). On the other hand, establishing truth in the judicial process cannot be enforced at any cost. In a state governed by the rule of law, there are specific legal grounds – the principle of fairness, confidentiality of information, protection of data, etc. – that may outweigh the establishment of the truth and hence lead to the exclusion of evidence (See, e.g., Nunner-Kautgasser, Anzenberger, 2016).
In contrast to the common law tradition, Lithuanian civil procedure does not offer the parties significant opportunities to obtain evidence from the opposing party or persons not involved in the case. Unlike, for example, US federal civil procedure, Lithuanian civil procedure does not include procedural instruments such as depositions or interrogatories. Moreover, in the US federal civil procedure, the production of evidence focuses not only on the specific evidence needed to reach a decision but also on evidence that is not necessarily relevant to the decision but that provides insight into the entire case (Radvany, 2016; Marghitola, 2015, p. 9). Not surprisingly, the wide range of options open to the parties in US federal civil proceedings also imposes detailed limits on the admissibility of evidence. The admissibility rules reasonably limit the broad possibilities of the parties and thus strike a balance between the need to establish the facts of the case and the protection of other values that are not necessarily linked to establishing the truth.
Lithuanian civil procedure differs in this respect; the CPC does not provide such broad access to evidence. Article 199 of the CPC, which regulates only the request for written evidence, is practically the only possibility for parties to obtain evidence in the possession of the other party or other persons. The aforementioned right of the presiding judge in civil proceedings to order the persons involved in the proceedings to produce evidence in their possession, as provided for in Article 160 of the CPC, is also not absolute. The court’s president may not take an inquisitorial part in the taking of evidence, thereby distorting the principle of the adversarial relationship between the parties and, even worse, appearing to be biased. This right of the president of the court should, therefore, be used only in exceptional circumstances.
Accordingly, any additional grounds for excluding evidence in Lithuanian civil proceedings may undermine the party’s ability to obtain the information necessary for the case and the court’s obligation to establish the facts. The latter situation may unbalance the entire evidentiary system in Lithuanian civil proceedings.
The risk of unbalancing the system has increased since the CJEU’s judgment. The introduction of an additional admissibility condition will, in many cases, lead to the fact that the production of evidence will simply become an ineffective and rarely used procedural instrument. As mentioned above, quite often, the content of the information requested and relevant to the case, will relate to the data of other persons collected for purposes other than use in legal proceedings. Such information could be rendered inadmissible in civil proceedings due to the requirements of the GDPR. In such a case, the party with the burden of proof will try to rely on less reliable, circumstantial evidence and, in some cases, will simply find itself at a dead end due to a lack of evidence to support its claims.
All of this can significantly hinder the parties’ ability to prove and the court’s ability to determine the facts, i.e. the truth in a civil case. In civil proceedings, the court must establish not just any truth, but the substantive truth. Substantive truth will be established if the court has the opportunity to ascertain as far as possible the facts at issue and, on that basis, to apply the rules of substantive law correctly (Parker, Lewisch, 1998 quoted Nekrošius, 2002, p. 37). Hence, excluding even a single piece of evidence from a case may prevent the court from establishing the substantive truth.
Secondly, the CJEU’s Judgment obliges the courts to assess balancing criteria that are quite complex and difficult to compare.
The CJEU’s Judgment will cause considerable headaches for the courts. As mentioned above, the CJEU has indicated that when faced with a party’s request for the production of evidence whose content includes personal data, a court will have to balance various conflicting criteria. This balancing has several problematic aspects:
1) The balancing criteria identified by the CJEU are very challenging to compare. As the renowned legal theorist Hans Kelsen has pointed out, “[...] the principle called “weighing of interests” is merely a formulation of the problem, not a solution. It does not supply the objective measure or standard for comparing conflicting interests with each other and does not make it possible to solve, on this basis, the conflict.” (Kelsen, 2005, p. 352). How should a national court decide that the right to an effective remedy overrides the right to private life? What standards should the court use to reach the latter conclusion? Should the court, in such a case, consider the views of the society of the Member State? The question arises then as to how the court will be able to identify those views? Moreover, what does the principle of proportionality tell the court in either case? These broad, multifaceted balancing criteria are extremely difficult to compare. As Justice Scalia has pointed out, albeit in a different context, “It is more like judging whether a particular line is longer than a particular rock is heavy.” (Bendix Autolite Corp. v. Midwesco Enterprises, Inc...).
2) Another related problem is that these broad and hardly comparable criteria mean that the decision whether to grant a party’s request for the production of evidence will be determined by the judge’s subjective interpretation of the circumstances of the case. In the absence of specific and clear balancing criteria, it will appear to one judge that the case is dominated by a clear interest in protecting the privacy of individuals. Another judge, on the other hand, will find that there is an interest in ensuring that a party’s right to be heard should be safeguarded, thereby fulfilling the court’s duty to establish the truth. Additionally, the courts may see different requirements stemming from such criteria as the right to a fair trial or proportionality principle. The latter criteria encompass various, and sometimes even different, aspects. In such instances, there is a clear risk that judges will not base their decisions on a pre-determined legal rule but rather on their personal views, beliefs, and experiences.
3) The third and final problem with the balancing test is that the balancing test stemming from the CJEU Judgment risks not providing legal certainty. How should a party assess whether the court will grant its request to produce evidence? It will be pretty difficult for the parties to predict how the court will decide to balance the broad and multifaceted criteria in one or another situation. Unfortunately, this uncertainty will, in some cases, also prevent a party from predicting its chances and success during the evidentiary proceedings, which may unduly discourage a party from pursuing his or her rights in court.
As can be seen, the situation is indeed complicated – the CJEU’s Judgment will oblige the courts of first instance to engage in a virtually constitutional balancing test while deciding on the admissibility of the evidence. As shown above, this will undoubtedly create normative problems and make the entire evidentiary process more expensive and lengthier.
Thus, the above considerations suggest that implementing the CJEU’s Judgment in the evidentiary system will be problematic. Firstly, the requirements arising from the GDPR will create obstacles to establishing substantive truth in court proceedings. Secondly, the balancing test arising from the GDPR is difficult to implement and often fails to provide legal certainty. Accordingly, the CJEU’s Judgment will create significant problems for the whole evidentiary process. It is beyond the scope of this article to answer how these problems could be addressed, but further analysis of these problems and options for their resolution should certainly be the subject of future research.
1. The CJEU’s Judgment provides essential interpretations of the GDPR in the context of civil procedure of the EU Member States. The CJEU not only indicated that Article 6(3) and (4) GDPR must be interpreted as applying to the production of evidence but also that Articles 5 and 6 GDPR must be interpreted as meaning that the national court, when assessing whether it is necessary to order the production of a document containing personal data, is required to take into account and balance the interests of the relevant data subjects in the light of the circumstances of the individual case.
2. The CJEU’s Judgment has a particularly significant impact on Lithuanian civil procedure. After the Judgment, the GDPR creates an additional requirement for the admissibility of evidence. The national court will have to weigh the various requirements of the GDPR against other competing interests in the civil proceedings to ascertain whether the evidence that constitutes personal data and is collected for purposes other than use in court proceedings is admissible.
3. The requirements of the CJEU’s Judgment will give rise to various problematic aspects. Firstly, the requirements arising from the GDPR unbalance the evidentiary system in Lithuanian civil proceedings and, consequently, will, in some cases, create substantial obstacles to establishing the substantive truth in court proceedings. Secondly, balancing criteria arising from the GDPR is complicated and, due to the broad content of these criteria, a balancing test cannot eliminate subjective decision-making and ensure legal clarity.
Charter of Fundamental Rights of the European Union. OJ C 202, p. 389–405.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). OJ L 119, p. 1–88.
Lietuvos Respublikos civilinio proceso kodeksas (2002), Valstybės žinios, 36–1340.
Bartkus, J. (2022). Įrodymų leistinumo samprata Lietuvos civiliniame procese ir arbitraže. Teisė, 122, p. 51–64, https://doi.org/10.15388/Teise.2022.122.4
Kelsen, H. (2005). Pure Theory of Law. The Lawbook Exchange, Ltd.
Kuner, C., Bygrave, L. A., Docksey, C., Drechsler, L. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford: Oxford University Press.
Marghitola, R. (2015). Document Production in International Arbitration. Kluwer Law International.
Nekrošius V. (2021). Įrodymų teisėtumas kaip jų leistinumo sąlyga Lietuvos civiliniame procese, Teisė, 1180, p. 8–17, https://doi.org/10.15388/Teise.2021.118.1
Nekrošius, V. (2002). Civilinis procesas: koncentruotumo principas ir jo įgyvendinimo galimybės. Vilnius: Justitia.
Nunner-Kautgasser, B., Anzenberger, P. (2016). Inadmissible Evidence: Illegally Obtained Evidence and the Limits of the Judicial Establishment of Truth. In: Rijavec, V., Keresteš, T., Ivanc, T. (eds.) (2016). Dimensions of Evidence in European Civil Procedure. Kluwer Law International, 195–213.
Radvany, P. (2016). The Importance of the Federal Rules of Evidence in Arbitration. The Review of Litigation, 36 (3), p. 469–512.
Stein, A. (2015). Inefficient Evidence. Alabama Law Review, 66, p. 423–470.
Sunstein, C. (1995). Problems with Rules. California Law Review, 83 (4), p. 953–1026.
Voigt, P., von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR) A Practical Guide. Springer Cham.
Norra Stockholm Bygg [CJEU], No. C-268/21, [02.03.2023], ECLI:EU:C:2023:145.
Decision of the Supreme Court of the United States of 17 June 1988, Bendix Autolite Corp. v. Midwesco Enterprises, Inc., No. 486 U.S. 888 (1988).
|
Jurgis Bartkus yra Vilniaus universiteto Teisės fakulteto Privatinės teisės katedros jaunesnysis asistentas, socialinių mokslų daktaras. Pagrindinės jo mokslinių interesų, tyrimų ir ekspertinės sritys – įrodymai ir įrodinėjimas, arbitražo teisė, civilinio proceso teisė, teisinis argumentavimas, sprendimų priėmimas teismo procese. Jurgis Bartkus is a teaching assistant, Doctor of Social Sciences at the Private Law Department of the Faculty of Law, Vilnius University. His primary scientific interests and research areas include evidence and proof, arbitration law, civil procedure law, legal reasoning, and decision-making in court proceedings. |
1 Article 23(1)(f) and (j) of the GDPR provides: “Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: (f) the protection of judicial independence and judicial proceedings; … (j) the enforcement of civil law claims.”