# CJEU, Judgment of 2 March 2023, C-268/21, Norra Stockholm Bygg

Change of purpose and further processing in judicial proceedings: assessment under Article 6(3) and (4) GDPR, necessity and proportionality.

> Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/rechtsprechung/1.4.18-eugh-norra-stockholm-bygg
> Sprache: en



## 1 Overview [#1-overview]

The case concerned the obligation, in the context of Swedish civil proceedings, to produce an electronic staff register that had originally been compiled for tax control purposes. The CJEU clarifies the conditions under which such a change of purpose is permissible.

Reference: [CJEU, judgment of 2 March 2023, C-268/21, Norra Stockholm Bygg](https://curia.europa.eu/juris/liste.jsf?num=C-268/21\&language=de)

## 2 Further processing for new purposes [#2-further-processing-for-new-purposes]

The further processing of personal data for a purpose that differs from the purpose for which the data were originally collected is to be assessed against Article 6(3) and (4) GDPR. Member States may adopt legislative measures permitting such further processing, but must in doing so observe necessity and proportionality.

## 3 Requirements as to proportionality [#3-requirements-as-to-proportionality]

Courts must examine whether the production of all the data requested is strictly necessary. Where the relevant information can also be obtained by means that interfere less with data protection rights (for example by limiting the request to particular periods or to particular persons, or by anonymization), preference is to be given to that less intrusive means.


---

## About the author

This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en).

Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law.

According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.

Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.

His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.

For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.