Personal data and fair trial: balancing privacy rights and right to evidence

In a previous article, we highlighted how some employees have leveraged this ‘right of access’ in employment disputes — not always in good faith. In some cases, this right has been used strategically to delay or complicate litigation, to pressure employers into settlement negotiations by highlighting potential GDPR non-compliance, or to obtain evidence that might otherwise be difficult to secure through standard procedural channels.

On the other hand, employers, too, might be tempted to invoke the GDPR — rightly or wrongly — to resist or limit court orders requiring disclosure of certain documents based on the right to evidence. 

This delicate interplay between data protection and evidentiary rights was recently addressed by the French Court of Cassation in its decision of October 3, 2024​. 

At the heart of the case lies a pivotal question: how far can the GDPR be stretched — whether to facilitate or obstruct access to evidence — in employer/employees disputes? Specifically, can an employee, in the context of a union discrimination claim, licitly request access to company documents containing the personal data of colleagues hired under similar circumstances?

The right to evidence is indispensable to ensuring a fair trial and upholding the principle of “equality of arms” between the parties. The GDPR, however, imposes strict limits on the processing and disclosure of personal data to protect individual privacy. An inherent conflict becomes apparent when evidence involves such third-party data, as the pursuit of proof can directly clash with the obligation to safeguard privacy.

This tension between the right to evidence and data protection rules is illustrated in the case at hand, where an employee sued its employer for alleged union discrimination. To substantiate his claims, the employee requested that the court order his employer to provide various documents for comparison, including career histories and pay slips, pertaining to several employees. The labor court ruled in favor of the employee and directed the employer to disclose the requested documents.

The employer contested this decision before the Court of Appeal, but was unsuccessful, and subsequently appealed to the French Supreme Court (“Cour de Cassation”). The employer argued that the Court of Appeal had erred in ordering the production of these documents and invoked the right to protect the personal data of its employees, as guaranteed under the GDPR. 

The Cour de Cassation’s decision clarifies that, on the basis of a balance of interests and a hierarchy of norms, the protection of third-party personal data does not obstruct the right to evidence, while emphasizing however the need to control data disclosure for evidentiary purposes on a case-by-case basis.

To strike a balance between the right to evidence and data protection, the French Supreme Court emphasizes that this can only be achieved through a careful analysis of the rules governing each principle.

First, it recalls that producing documents containing personal data as evidence in judicial proceedings constitutes actual personal data processing, thus subject to the GDPR’s requirement for lawfulness under Article 6.

Further, as such processing is carried out for a purpose different from the one for which the data was originally collected, articles 6(3) and 6(4) GDPR apply. Therefore, the communication of such documents by the employer must:

In this case, the Cour de Cassation found that these conditions were met: national law prohibits union discrimination (Article L. 1132-1 of the French Labor Code), and requires the employee to present evidence suggesting the existence of such discrimination, which then allows the judge to order instigative measures, subject to proportionality checks (under Article L. 1134-1 of the same code).​

It is one thing to determine the lawfulness of document disclosure, but how is this process regulated in practice? What role should the judge play in overseeing the transmission of such data, now that is has been established that it does not in itself obstruct the right to evidence?  

One of the employer’s claims was that the documents were handed directly to the employee without adequate oversight. However, the Cour de Cassation clarified that when the requested documents are specific and legally defined — such as pay slips containing key personal information like the name, position, and classification of employees — there is no need for the judge to review the documents beforehand. 

That being said, the Court carefully emphasized that this does not relieve the judges from exercising their oversight. In fact, the ruling highlights the critical role of the judges in ensuring that data disclosure complies with legal safeguards, providing the following clear guidance on how to handle requests for relevant documents containing personal data (notably in discrimination cases): 

In light of these guidelines, the French Supreme Court annulled the Court of Appeal’s decision, which had ordered the employer to produce career histories and pay slips for nine specifically named employees, by merely stating that, to exercise their defense: 

The Cour de Cassation appears to have added an extra layer of scrutiny, requiring judges to apply a sort of a “GDPR filter” when assessing such requests. 

In previous rulings, the Court had reaffirmed the necessary balance between the right to evidence and the protection of personal data under the GDPR, using the criteria of necessity and proportionality, but without emphasizing the importance of data minimization and confidentiality: in one case, the Court upheld a decision of the Court of Appeal, which allowed an employee to access the salary slips of eight colleagues in similar positions to establish evidence of alleged gender pay discrimination. However, the disclosure was conditional, with personal data being redacted - except for names, job classifications, detailed monthly wages, and total gross annual salaries (Cass. soc., March 8, 2023, no. 21-12.492). Another ruling reinforced that the communication of names and pay details was both necessary and proportionate for the protection of the employee's right to prove potential discrimination (Cass. soc. June 1, 2023, no. 22-13.244).

What can we take away from the October 3rd 2024 decision? 

For the judge, this means not only limiting the scope of the data produced to what is strictly necessary to prove the claim (e.g. there is no need for a social security number or a personal address to establish union discrimination), but also ensuring that only the minimum essential data needed to establish the facts (both in terms of quality and quantity) is disclosed — while maintaining its confidentiality.

For employers, this bears clear implications:

Failing to anticipate and manage personal data within the context of litigation can lead to lengthy and costly procedures, both in terms of time and financial resources. To mitigate this, companies are strongly advised to implement effective preventative measures, notably: 

If you are facing challenges in managing personal data during litigation, or if your company has not yet implemented the necessary preventive measures, do not hesitate to contact us for expert advice and support.