The ECJ has ruled in the Judgment in Case C‑484/24 In the NTH Haustechnik case of June 18, 2026, it was decided that a national court Evidence containing personal data may be used even if they were obtained by the submitting party in violation of the GDPR. The GDPR does not impose a prohibition on the use of such data. Anyone who decides on the admissibility of evidence and evaluates evidence is fulfilling a legal obligation, which is why Article 6(1)(c) of the GDPR applies. Contrary to the position of the Federal Labor Court (BAG), Article 17(3)(e) of the GDPR does not constitute a legal basis (it is merely an exception to the right to erasure). Furthermore, a court is not required to conduct its own proportionality assessment involving a balancing of interests for every instance of data processing. It is sufficient to assess whether the data used is appropriate and relevant to the purpose and limited to what is necessary.
The following finding by the European Court of Justice is of greater practical relevance:
… it should be noted that, under certain circumstances, several alternative conditions for lawfulness may apply to the same processing.
In other words, several legal bases may apply at the same time. This is not surprising in itself, but had not been established by the ECJ until now.
It therefore remains unclear whether the controller can switch to a different legal basis in the event of a dispute. One argument against this is that the duty to provide information requires the legal bases to be specified — this would be undermined if the controller could switch to an unspecified legal basis; however, it is not clear whether such a switch would affect only the duty to provide information or would also exclude the other legal bases. In any case, it is advisable to list all relevant legal bases in the privacy policy.