Ex-wife's eBay account sparks fight over hacked evidence

A family split, a private eBay account and a disputed password reset landed Thursday before Europe's highest court, which ruled that evidence does not automatically become unusable simply because the personal data behind it may have been obtained unlawfully.

NTH Haustechnik GmbH is seeking compensation from a former employee identified only as EM, saying she sold company-owned goods through her personal eBay account and caused more than 46,000 euros (about $52,800) in losses. EM denies wrongdoing, saying many of the items were defective customer returns or obsolete stock that the company no longer wanted and had effectively given her.

A German labor court turned to the Court of Justice of the European Union for guidance on whether information obtained through a possible breach of Europe's privacy rules must be excluded from civil proceedings.

The answer, the judges said, depends on the circumstances.

National courts remain free to decide whether such evidence can be used, and the mere fact that personal data may have been obtained unlawfully is not enough to keep it out of the courtroom.

"The fact that the data concerned were obtained in breach of the right to the protection of privacy and the right to the protection of personal data … does not appear, in itself, to be decisive," the judges wrote.

The court also rejected the argument that a provision in the bloc's privacy regulation allowing data to be retained for legal claims creates a separate legal basis for processing personal information, saying the regulation already contains an "exhaustive and restrictive list of the cases in which processing of personal data can be regarded as being lawful."

Judges further said when courts evaluate whether evidence is admissible, the use of personal data "does not, in principle, mean any infringement of the principle of 'data minimization' occurs," because the information may be necessary to determine whether the evidence can be considered.

EM worked for NTH and was married to the company's managing director. Although her employment ended in October 2019, she continued to have access to company premises and computers until the couple separated in June 2022. NTH says it later uncovered more than 13,000 euros (about $14,900) in sales through EM's private eBay account, arguing that the losses went far beyond the sale proceeds because the company was left without the goods and had to replace them.

According to the German court, NTH says the couple's son, identified as F., found traces of the eBay account in a computer browsing history and obtained the password from a family file stored on a company server.

EM disputes that version. She says she never stored her password on company systems and claims the managing director reported her company-registered phone as lost, obtained a replacement SIM card and used control of the phone number to reset the password and gain access to her private account.

German judges said they could not rule out the possibility that the data had been obtained unlawfully.

The General Data Protection Regulation, which took effect in 2018, gives individuals extensive rights over their personal information and places strict limits on how companies and public bodies collect, store and use data. The law has become one of the world's most influential privacy regimes and has generated years of litigation over where those protections begin and end.

The Luxembourg judges noted that courts themselves process personal data whenever they receive, review and evaluate evidence. Before placing documents in the file, national courts must ensure the information is limited to what is necessary for deciding the dispute and may consider measures such as full or partial anonymization. Courts are also generally required to consider all admissible evidence needed to assess a case fairly, including the relevance and significance of the material before them.

Gregor Thüsing, director of the Institute for Labor Law and Social Security Law at the University of Bonn and a member of Germany's Ethics Council, said the judgment confirms the broad discretion national courts retain when assessing contested evidence that implicates privacy concerns.

Limits on the use of personal data and broader rights to privacy do not "automatically preclude national courts from relying on evidence obtained in breach of privacy and data protection rights," Thüsing said. He also noted the judges clarified that personal data does not become fair game simply because it appears in court proceedings. Instead, the processing of such data by courts is justified by their legal duty to resolve disputes before them.

But where Thüsing saw flexibility, Peter Wedde, emeritus professor of labor law and information society law at Frankfurt University of Applied Sciences, saw a risk that the ruling could weaken data protection safeguards in practice.

"With this positioning, the court does not do justice to the GDPR's primary objective of ensuring a high level of protection for the fundamental rights and freedoms of natural persons," Wedde said.

At the same time, Wedde stressed the judgment places an important condition on the use of unlawfully obtained employee data. Such information may be considered only where national law provides courts with clear, precise and predictable rules governing when personal data collected without a valid legal basis can be used as evidence.

"The clear, precise and predictable national case law from German courts … does not yet exist in Germany," Wedde said. Until such standards are established, he noted, courts cannot rely on employee data gathered in breach of privacy and data protection rules. In his view, German labor courts, particularly the Federal Labor Court, must now develop that framework.

NTH did not respond to a request for comment. EM is a private individual and no lawyer representing her could be identified. She could not be reached for comment.

The Court of Justice did not decide whether EM improperly sold company property or whether NTH obtained the eBay information unlawfully. With no further appeal possible in Luxembourg, those questions now return to the Higher Labour Court of Lower Saxony, which must decide whether the disputed eBay evidence can be used and, ultimately, whether EM owes damages to her former employer.

Courthouse News reporter Eunseo Hong is based in the Netherlands.