c) data minimisation
5 preliminary rulingsJudgment of 18 Jun 2026, C-484/24 (NTH Haustechnik) 
Article 5(1)(c) of Regulation 2016/679, read in conjunction with the second sentence of Article 52(1) of the Charter of Fundamental Rights must be interpreted as meaning that the principle of ‘data minimisation’ does not require a court to ensure, for each processing of personal data it undertakes, that the principle of proportionality is observed, by ensuring that the data processed on that occasion are such as to enable the objective pursued by that processing to be achieved and are strictly necessary for achieving it, and that the seriousness of the interference with fundamental rights entailed by taking such data into account in order to undertake that processing is proportionate to the interest which that court has in using those data to undertake that processing, provided that the conditions laid down in Article 5(1)(c) of Regulation 2016/679 are met.
Articles 7 and 8 of the Charter of Fundamental Rights, Article 5(1) of Regulation 2016/679, point (c) of the first subparagraph of Article 6(1) of that regulation, read in conjunction with Article 6(3) thereof, and the principle of ‘data minimisation’ must be interpreted as not precluding a national court from using evidence containing personal data obtained in breach of the right to privacy and the right to the protection of personal data by the party which transmitted such data to that court, where that party’s legitimate interest in such processing does not outweigh the interest in simply adducing the facts on which it relies. By contrast, before disclosing those data to the parties or third parties, that court must verify that such data are limited to what is necessary in relation to the purposes for which such disclosure is made and, as appropriate, take certain measures to minimise the impediment to the right to the protection of personal data which such disclosure is likely to entail.
Judgment of 9 Jan 2025, C-394/23 (Mousse)
Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation, must be interpreted as meaning that – the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract; – the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where: – those customers were not informed of the legitimate interest pursued when those data were collected; or – that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or – in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
Judgment of 4 Oct 2024, C-446/21 (Schrems)
Article 5(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that the principle of data minimisation provided for therein precludes any personal data obtained by a controller, such as the operator of an online social network platform, from the data subject or third parties and collected either on or outside that platform, from being aggregated, analysed and processed for the purposes of targeted advertising without restriction as to time and without distinction as to type of data.
Judgment of 2 Mar 2023, C-268/21 (Norra Stockholm Bygg)
Articles 5 and 6 of Regulation 2016/679 must be interpreted as meaning that when assessing whether the production of a document containing personal data must be ordered, the national court is required to have regard to the interests of the data subjects concerned and to balance them according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation referred to in Article 5(1)(c) of that regulation.
Judgment of 20 May 2003, C-465/00 (Rechnungshof)
Articles 6(1)(c) and 7(c) and (e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data do not preclude national legislation such as that at issue in the main proceedings, provided that it is shown that the wide disclosure not merely of the amounts of the annual income above a certain threshold of persons employed by the bodies subject to control by the Rechnungshof but also of the names of the recipients of that income is necessary for and appropriate to the objective of proper management of public funds pursued by the legislature, that being for the national courts to ascertain.
Articles 6(1)(c) and 7(c) and (e) of Directive 95/46 are directly applicable, in that they may be relied on by an individual before the national courts to oust the application of rules of national law which are contrary to those provisions.
