Evidence from personal data: admissibility in civil proceedings

Evidence obtained at the cost of an interference with personal data is not automatically excluded from civil proceedings. Where a party asks it to do so, the court must balance the right to evidence against the competing rights. Two cumulative conditions apply: production must be indispensable to the exercise of the right to evidence, and the interference must be strictly proportionate to the aim pursued. The commercial chamber applies this review to an internal audit report produced in election litigation.

The essentials

• In civil proceedings, evidence obtained unlawfully or unfairly is not necessarily excluded: the court carries out a balancing exercise where a party asks it to do so.
• Producing material that interferes with other rights requires two cumulative conditions: it must be indispensable to the exercise of the right to evidence, and it must cause an interference that is strictly proportionate to the aim pursued.
• A purely volumetric analysis of pseudonymised data, with no name-based file, together with destruction of the original data and findings recorded by a commissioner of justice (commissaire de justice), characterises a very limited interference.
• The designation, by the employee shareholders, of the candidate for the directorship is governed by the general principles of electoral law.
• A misleading and virulent campaign, coupled with a breach of equality in campaigning resources, may justify annulling a ballot in which the final margin remains narrow.

An internal audit produced to challenge a ballot

The commercial chamber dismisses the appeal to the Cour de cassation (France's highest civil court): the report of an audit firm based on pseudonymised data could be produced, and the ballot annulled (Com., 17 June 2026, No. 25-11.499). The board of directors of the public limited company (société anonyme) concerned, the parent company of a group, has fifteen members, one of whom represents the employee shareholders.

The method of designating this representative derives from the articles of association, a company-level collective agreement and an electoral regulation. Votes are cast for a pair comprising a principal and a substitute. Two pairs stood for election by the employee shareholders, one supported by a trade union and an association of employee shareholders, the other by another trade union. One pair came first in the first round; the other won the second round, two weeks later.

A trade union and the candidate who came first in the first round brought proceedings against the company and the other parties before a commercial court, seeking annulment of the second round. By decision of its board of directors, management instructed an audit firm to carry out a technical analysis of the voting operations. That firm's preliminary report was placed on the record on appeal.

The decision under appeal (CA Versailles, 10 December 2024, No. 24/02869) admitted that production and annulled the second round. The parties bringing the appeal argued that the court of appeal could not rely on that report without verifying that the employees whose data had been processed had been informed, an obligation they derived from Article 14 of the GDPR. The commercial chamber holds those complaints ineffective: the reasoning relating to the lawfulness of the processing was superfluous.

The rule applied is that of the balancing exercise, based on Article 6, § 1, of the Convention for the Protection of Human Rights and Fundamental Freedoms and on Article 9 of the French Code of Civil Procedure. The court carries out that exercise where a party asks it to do so, in the following terms (free translation).

It follows from Article 6, § 1, of the Convention for the Protection of Human Rights and Fundamental Freedoms and from Article 9 of the French Code of Civil Procedure that, in civil proceedings, unlawfulness or unfairness in obtaining or producing an item of evidence does not necessarily lead to its exclusion from the proceedings.

Evidence derived from personal data: the two conditions

Evidence derived from personal data may be produced where its production is indispensable to the exercise of the right to evidence and the interference remains strictly proportionate to the aim pursued. The two conditions are cumulative. The court carries out this examination only if a party asks it to do so.

A party wishing to have an item of evidence excluded must therefore act. It identifies the right interfered with – protection of personal data, privacy, trade union freedom – and explains why the interference is disproportionate. The court of appeal also noted that the natural persons concerned, who were parties to the proceedings, alleged no personal interference with their own data or with their privacy.

The technical arrangements of the audit weigh heavily in the balance. The court of appeal relied on the report itself and on five findings recorded by a commissioner of justice during the operations. Those findings describe precisely the processing applied to the employees' data.

that subcontractor had pseudonymised all the personal data used, destroyed the original data, which did not include the content of emails, then carried out a purely volumetric analysis of the pseudonymised data giving rise to no name-based file

The commercial chamber approves the inference drawn by the lower court judges. Given the content of that report, the right to evidence of the company, the trade union and the candidate justified its production, which was necessary to their defence and proportionate to "the extremely limited interference with the confidentiality of the protected data and with trade union freedom".

What scope for internal investigations and ballots?

The decision confirms that the balancing of the right to evidence applies fully where the evidence rests on personal data, without thereby validating the processing itself. The distinction governs what follows: admitting an item of evidence is not the same as declaring lawful the processing that produced it.

The court of appeal had held the processing lawful, in the light of the legitimate interest of the company, which was required to defend in court the validity of the electoral process it had organised. The commercial chamber describes that reasoning as superfluous and therefore did not have to endorse it. The question of informing the persons concerned, raised on the basis of Article 14 of the GDPR, remains open.

On the electoral aspect, the decision approves the lower court judges for having correctly applied the general principles of electoral law to the designation of the candidate by the employee shareholders. The court of appeal had held that irregularities annul a ballot only if they directly conflict with those principles or if they influenced the result. Assessing that influence is a matter for the lower court judges.

Two findings led to the annulment of the second round. A trade union's communications during the campaign had exceeded "the permissible limits of freedom of trade union expression and of electoral controversy". Equality in campaigning resources had, moreover, been broken. The narrow margin between the pairs in proportion to the electorate, followed by the reversal of the results within two weeks, led the judges to hold that the ballot had been distorted.

Securing an internal investigation intended for litigation

A company investigating its own systems designs that investigation with the court in mind, because the admissibility of the report will depend on documented technical safeguards. The firm instructed in this case created no name-based file and did not review the content of the messages. Those choices reduced the interference with the employees' rights.

• Confine the collection to the suspected facts and exclude the content of the messages exchanged.
• Pseudonymise the data used, then destroy the original data.
• Have the collection, pseudonymisation and destruction operations recorded by a commissioner of justice.
• Keep to a volumetric analysis, with no reconstruction of a name-based file.
• Keep a written record of the scope of the assignment given to the third party and of the timetable of operations.

For the organisation of an internal ballot, the electoral regulation binds candidates and their supporters alike. The court of appeal held that any communication to voters required the prior and direct provision of contact details by their recipients. An organisation that canvasses employees without being able to establish that point exposes itself to a finding that equality between candidates has been broken.

The checks to carry out before producing a report

Before placing an investigation report on the record, three checks are required. Production must be indispensable to the defence of the party relying on it. The technical safeguards – pseudonymisation, destruction of the original data, absence of a name-based file, findings recorded by a third party – must be documented and capable of being demonstrated. Finally, the interference must remain proportionate to the aim pursued and confined to the facts in dispute. Where an opposing party's evidence is considered irregular, the application to have it excluded must be made expressly before the court, identifying the right interfered with and the concrete nature of the interference.