In its Judgment in Case C-484/24 dated 18 June 2026, the Court of Justice of the European Union (CJEU) clarified that evidence obtained by one of the parties in possible violation of the GDPR must not be automatically excluded from the proceedings solely for that reason. Specifically, the CJEU ruled that national courts carry out a distinct data processing operation when they receive and analyse the evidence, and this may be based on the legal obligation to examine the evidence.
The ruling is particularly relevant in labour disputes, where the use of evidence containing personal data is frequent (e.g., records of internal communications, activity monitoring reports, time-tracking data, or electronic correspondence). In practice, the CJEU’s decision confirms that such evidence is not automatically excluded on the grounds of a violation of the GDPR, but courts will have to assess the proportionality of using such data, ensuring that the processing is limited to what is strictly necessary for resolving the case.