Case Note: Which Must Be Determined First, the Purposes of Processing or Data Controllership? The Judgment of the CJEU in Norra Stockholm Bygg of 2 March 2023 and the Interpretation of the Concept of Further Processing in Civil Proceedings

In March 2023, the Court of Justice of the European Union (CJEU) handed down its much criticized judgment in the Norra Stockholm Bygg case, on the applicability of data protection law in the context of civil proceedings when a court is deciding whether to order the production of evidence. The findings of the CJEU, particularly on the applicability of Article 6(3) and (4) of the General Data Protection Regulation (GDPR) on the processing personal data for a purpose other than that for which the data were collected, deserve a closer look, because additional data protection obligations have been imposed on courts acting in their judicial capacity. This case note analyses the answers of the CJEU to the two questions posed by the Swedish Supreme Court, and highlights the consequences of what appears to have been an overlook of the concept of controllership before the CJEU started to consider the interpretation of the provisions on purpose limitation and further processing.