a)

When processing data – in particular personal data – can a national court rely on the fact that such processing is authorised under Article 17(3)(e) of the GDPR, or do Articles 6 and 9 of the GDPR constitute the exclusive basis for judicial processing activities?

b)

If Article 17(3)(e) of the GDPR can in principle form a legal basis for judicial processing activities:

(aa)

Does this also apply to cases in which the original collection of those data by a litigant or a third party was not lawful?

(bb)

Does the processing of originally unlawfully collected data under the generally applicable principle of good faith (Article 5(1)(a) of the GDPR) lead to a restriction of judicial processing under secondary law in the sense that Article 17(3)(e) of the GDPR is only applicable under certain conditions or within certain limits?

(cc)

Is the provision in Article 17(3)(e) of the GDPR to be understood in such a way that a prohibition on the judicial utilisation of originally unlawfully obtained data is always excluded – i.e. the court must always utilise those data – if the original data collection was not covert and was used to prove an intentional breach of duty?

a)

Do the principles of necessity and data minimisation under data protection law pursuant to Article 52(1) sentence 2 of the CFR, Article 5(1)(a) of the GDPR, in particular with regard to the processing of originally unlawfully collected or stored data, give rise to the need for a comprehensive proportionality test and balancing by the courts?

b)

What impact does Article 5(1)(e) of the GDPR, which stipulates that personal data may be kept for no longer than is necessary for the purposes for which such data are processed, have on subsequent judicial data processing activities, in particular in cases where

c)

Does it follow from EU law, in particular from Article 8 of the CFR, Article 6(1)(c) or (e), (3), Article 9 of the GDPR, that the national court can utilise evidence that was obtained in violation of personal rights only if there is a recognisable interest of the party bearing the burden of proof that goes beyond the simple interest in evidence, or do no requirements follow from EU law in this respect, such that it is up to the national legal system to make provisions in that regard?

d)

Does it follow from Article 47(2) of the CFR, which guarantees the right to effective judicial protection and, in particular, to a fair trial, according to which the parties to civil proceedings must in principle be able sufficiently to substantiate and prove their legal protection objective, that the judicial processing of personal data of the applicant employee unlawfully collected by the employer can only be inappropriate and disproportionate in the narrower sense if the data collection under EU law would prove to be a serious infringement of Article 7 and Article 8 of the CFR and other possible sanctions for the employer (e.g. compensation for damages under Article 82 of the GDPR and the imposition of fines under Article 83 of the GDPR) would be completely inadequate, or can inappropriateness and disproportionality be established even in the case of other, less serious breaches of data protection law during the original data collection?

e)

When deciding whether to utilise the data originally collected from a party or a third party as part of its judicial data processing activities, does the court have to take into account whether the data collector has complied with its information obligations under Article 13 of the GDPR? If so: Under what conditions and according to what standards must the court take this into account?

f)

Does the fact that the Court is bound by the GDPR and the Charter of Fundamental Rights of the European Union when processing personal data also include the personal data of third parties? In what way does a possible breach of data protection law in the original data collection have an effect on any subsequent judicial data processing in a dispute between two parties? Can a party rely on an offence committed not against it but against third parties, or is that not the case?