Abstract;Judgment — ECLI:EU:C:2025:2
Date: 2025-01-09
Language of the case: French
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: France

Translation C-394/23 – 1 
Case C-394/23 
Request for a preliminary ruling 
Date lodged:  
28 June 2023 
Referring court:  
Conseil d’État (France) 
Date of the decision to refer:  
21 June 2023 
Applicant:  
Association Mousse 
Defendant:  
Commission nationale de l’informatique et des libertés (CNIL) 
SNCF Connect 
  
CONSEIL D’ÉTAT (COUNCIL OF STATE) 
acting 
in its judicial capacity 
[…] 
Having regard to the following procedural stages: 
By an application registered on 21 May 2021 and two statements in reply 
registered on 3 June 2022 at the secretariat of the judicial section of the Conseil 
d’État (Council of State), the association Mousse requests that the Council of 
State: 
1. annul, as being ultra vires, the decision of 23 March 2021 by which the 
Commission nationale de l’informatique et des libertés (French Data Protection 
Authority) rejected its complaint brought against the company responsible for the 
website OUI.sncf; 
EN 
REQUEST FOR A PRELIMINARY RULING OF 21. 6. 2023 – CASE C-394/23 
 
2  
2. prior to ruling on those claims, refer to the Court of Justice of the European 
Union [two questions for a preliminary ruling] […]: 
[…] 
[Proposed questions for a preliminary ruling] 
3. order SNCF Connect, the company responsible for the website, to remove 
the obligation to complete the field ‘Mr’ or ‘Ms’ in order to make a purchase, to 
delete from its databases the information gathered by means of that field and, in 
the event that the company should wish to collect data on ‘gender’, to add one or 
more additional non-binary choices such as ‘neutral’ or ‘other’; 
[…] 
It submits that: 
- the obligation to complete one of the two headings ‘Mr’ or ‘Ms’ in order to 
purchase a travel ticket, a discount card or a season ticket online on the ‘SNCF 
Connect’ website does not meet the requirements of lawfulness, fairness and 
transparency laid down in Article 5(1)(a) of Regulation [(EU) 2016/679] of the 
European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data and on the free 
movement of such data (‘the GDPR’), since the customer does not give his or her 
consent, such information is not necessary either for the performance of the 
contract or for compliance with a legal obligation, nor is it necessary for the 
purposes of legitimate interests, while it results in an infringement of the right to 
travel without disclosing one’s civil title and of the right to respect for private life, 
which includes, inter alia, the freedom freely to define one’s gender expression, 
and a risk of discrimination; 
- that obligation is not mentioned in the legal information on the website or in 
the general terms and conditions of sale; moreover, the identity and contact details 
of the controller are not mentioned, nor is the legal basis for the processing; the 
principles of fairness and transparency set out in Article [5](1)(a) of the GDPR 
and the right to information guaranteed by Article 13 thereof are thus infringed; 
- that obligation does not serve any of the purposes mentioned in the online 
contract; the fact that the expressions ‘Mr’ and ‘Ms’ are used in commercial 
correspondence cannot suffice to make the collection of those data necessary; 
some transport companies outside France do not require it; moreover, OUI.sncf 
does not use civil titles in its correspondence with its customers; consequently, the 
obligation is contrary to the principle of data minimisation set out in 
Article 5(1)(c) of the GDPR; 
- for some people, those indicators do not correspond to reality and do not 
take account of the fact that that reality may change; thus, the obligation at issue is 
contrary to the principles of accuracy and updating set out in Article 5(1)(d) of the 
MOUSSE 
 
3 
GDPR and exposes those persons to the risk of discrimination; furthermore, for 
nationals of countries whose civil status allows ‘neutral gender’, the obligation 
infringes the principle of mutual recognition, the freedom to provide services and 
the freedom of movement guaranteed by EU law. 
By two statements of defence, registered on 5 May 2022 and 30 May 2023, the 
French Data Protection Authority contends that the application should be 
dismissed or, failing that, that a question should be referred to the Court of Justice 
of the European Union for a preliminary ruling. It submits that the pleas relied on 
are unfounded. 
By two statements of defence, registered on 19 January and 31 May 2023, the 
company SNCF Connect contends that the application should be dismissed and 
that the association Mousse should be ordered to pay the sum of EUR 10 000 
pursuant to Article L. 761-1 of the code de justice administrative (Code of 
Administrative Justice). It contends that the pleas relied on are unfounded. 
Having regard to the other documents in the file; 
Having regard to: 
– […] 
– the European Convention for the Protection of Human Rights and Fundamental 
Freedoms; 
– the Treaty on European Union; 
– the Treaty on the Functioning of the European Union; 
– the Charter of Fundamental Rights of the European Union; 
– Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016; 
– […]; 
– Law No 78-17 of 6 January 1978; 
– […]; 
[…] 
Whereas: 
1 The association Mousse lodged a complaint with the French Data Protection 
Authority (CNIL) against the company SNCF Voyageurs, which was 
subsequently succeeded by OUI.sncf and now SNCF Connect, on the ground that 
the conditions under which customers’ civil titles were collected and recorded 
REQUEST FOR A PRELIMINARY RULING OF 21. 6. 2023 – CASE C-394/23 
 
4  
during the purchase of train tickets, season tickets and discount cards on the 
company’s website or applications infringed certain provisions of Regulation 
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on 
the protection of natural persons with regard to the processing of personal data 
and on the free movement of such data and repealing Directive 95/46/EC (‘the 
GDPR’). By letter of 23 March 2021, the CNIL informed the association that it 
took the view that the matters alleged against the company did not constitute 
infringements of the provisions of the GDPR relied on and that, consequently, it 
was closing the complaint. The association Mousse is seeking the annulment of 
that decision and is also seeking an injunction against SNCF Connect and the 
imposition of an administrative fine on it. 
2 In accordance with Article 8 of the loi du 6 janvier 1978 relative à l’informatique, 
aux fichiers et aux libertés (Law of 6 January 1978 on information technology, 
files and liberties): ‘I- The French Data Protection Authority is an independent 
administrative authority. It is the national supervisory authority within the 
meaning of, and for the purposes of applying, Regulation (EU) 2016/679 of 
27 April 2016. It carries out the following tasks: … 2. It ensures that the 
processing of personal data is carried out in accordance with the provisions of 
this law and other provisions relating to the protection of personal data laid down 
in laws and regulations, EU law and France’s international commitments. To that 
end: … (d) It handles complaints, petitions and claims lodged by a data subject or 
by a body, organisation or association, examines or investigates, to the extent 
necessary, the subject matter of the complaint and informs the complainant of the 
progress and outcome of the investigation within a reasonable period, in 
particular if further investigation or coordination with another supervisory 
authority is necessary …’. 
3 It follows from the provisions referred to in paragraph 2 that it is for the French 
Data Protection Authority (CNIL), when dealing with a complaint or a claim 
concerning the exercise of its powers, to examine the underlying facts and to 
decide on the action to be taken. To that end, it enjoys a broad discretion and may 
take into account the gravity of the alleged breaches in the light of the legislation 
or rules which it is responsible for enforcing, the reliability of the evidence 
relating to those acts, the date on which they were committed, the context in 
which they were committed and, more generally, all the general interests for 
which it is responsible. A complainant may refer the CNIL’s refusal to act on that 
complaint to a court with jurisdiction to examine cases of misuse of powers. It is 
for that court to censure that refusal, if appropriate, on grounds of formal 
unlawfulness and, in respect of the merits of the decision, in the event of an error 
of fact or of law, a manifest error of assessment or misuse of powers. However, 
where the complainant alleges that a controller has infringed the rights guaranteed 
by law to the data subject in respect of personal data concerning him or her, in 
particular the rights of access, rectification, erasure, restriction and objection 
referred to in Articles 49, 50, 51, 53 and 56 of the Law of 6 January 1978 on 
information technology, files and liberties, the exercise of the CNIL’s discretion 
to decide on the action to be taken, having regard to the nature of the individual 
MOUSSE 
 
5 
right in question, is subject in full to review by the court hearing the case of 
misuse of powers. 
4 It is clear from the documents in the file [that] the association Mousse is seeking 
the annulment, as being ultra vires, of the decision of 23 March 2021 by which 
the President of the CNIL closed its complaint concerning the conditions for the 
collection and processing of customers’ civil titles by OUI.sncf, now SNCF 
Connect. 
5 Under Article 5 of the GDPR: ‘1. Personal data shall be: (a) processed lawfully, 
fairly and in a transparent manner in relation to the data subject …; (c) adequate, 
relevant and limited to what is necessary in relation to the purposes for which 
they are processed …; (d) accurate and, where necessary, kept up to date; every 
reasonable step must be taken to ensure that personal data that are inaccurate, 
having regard to the purposes for which they are processed, are erased or 
rectified without delay’. In accordance with Article 6 of the GDPR: ‘1. Processing 
shall be lawful only if and to the extent that at least one of the following applies: 
(a) the data subject has given consent to the processing of his or her personal 
data for one or more specific purposes; (b) processing is necessary for the 
performance of a contract to which the data subject is party or in order to take 
steps at the request of the data subject prior to entering into a contract; (c) 
processing is necessary for compliance with a legal obligation to which the 
controller is subject; (d) processing is necessary in order to protect the vital 
interests of the data subject or of another natural person; (e) processing is 
necessary for the performance of a task carried out in the public interest or in the 
exercise of official authority vested in the controller; (f) processing is necessary 
for the purposes of the legitimate interests pursued by the controller or by a third 
party, except where such interests are overridden by the interests or fundamental 
rights and freedoms of the data subject which require protection of personal data, 
in particular where the data subject is a child. Point (f) of the first subparagraph 
shall not apply to processing carried out by public authorities in the performance 
of their tasks.’ Article 13 of the GDPR imposes an obligation on the controller to 
provide information to any person whose personal data are collected. Lastly, 
Article 21 of that regulation gives data subjects the right to object at any time, on 
grounds relating to their particular situation, to processing which is based on 
Article 6(1)(f). 
6 In its complaint to the CNIL, the association Mousse submitted that, in order to 
purchase a train ticket, season ticket or discount card online on the ‘OUI.sncf’ 
(now SNCF Connect) website or application, customers are required to indicate 
their civil title and have the choice in that regard between two options, ‘Mr’ or 
‘Ms’. In its view, such data collection is not lawful, within the meaning of 
Article 5(1)(a) of the GDPR, since it is not based on any of the grounds set out in 
Article 6(1), it infringes the principles of data minimisation and accuracy also laid 
down in Article 5(1)(c) and (d) and, lastly, SNCF does not comply with the 
requirements in terms of transparency and information imposed by Article 5(1)(a) 
REQUEST FOR A PRELIMINARY RULING OF 21. 6. 2023 – CASE C-394/23 
 
6  
and Article 13. It submits that the company should not collect such data or should, 
at the very least, offer one or more additional options, such as ‘neutral’ or ‘other’. 
7 In deciding to close the complaint submitted to it, the CNIL, first, noted that, in 
the context of the provision of transport services by the company, the contract 
concluded with its customer constituted the legal basis for the processing. Thus, as 
regards the various legal bases provided for by Article 6(1) of the GDPR, it 
considered only that the processing at issue came within the scope of that 
provided for in point (b), according to which processing is lawful if it is 
‘necessary for the performance of a contract to which the data subject is party or 
in order to take steps at the request of the data subject prior to entering into a 
contract’. Secondly, it took the view that the collection of customers’ civil titles 
could be regarded as necessary in relation to the purposes of the processing, 
within the meaning of Article 5[(1)](c), and therefore as satisfying the data 
minimisation requirement, since addressing customers by using their civil title 
corresponds to usual practice in civil, commercial and administrative 
communications. In its defence, it submits, inter alia, that the processing of the 
civil title could also be regarded as necessary for the purposes of the legitimate 
interests pursued by SNCF Connect, within the meaning of Article 6(1)(f), and 
that, in that case, the data subjects could, depending on their particular situation, 
exercise the right to object guaranteed to them by Article 21. 
8 The question whether, in order to assess whether the data collection is adequate, 
relevant and limited to what is necessary, within the meaning of Article 5(1)(c) of 
the GDPR and the need for processing in accordance with Article 6(1)(b) and (f), 
account may be taken of commonly accepted practices in civil, commercial and 
administrative communications, with the result that the collection of data relating 
to customers’ civil titles, which is limited to ‘Mr’ or ‘Ms’, may be regarded as 
lawful, without this being precluded by the principle of data minimisation, raises a 
difficulty in the interpretation of EU law which is decisive for the resolution of the 
dispute before the Council of State. The same applies to the question whether, in 
order to assess the need for the compulsory collection and processing of data 
relating to customers’ civil titles, even though some customers consider that they 
do not come under either of the two civil titles and that the collection of such data 
is not relevant in their case, account should be taken of the fact that those 
customers may, after having provided those data to the data controller in order to 
benefit from the service offered, exercise their right to object to the use and 
storage of those data by relying on their particular situation, in accordance with 
Article 21 of the GDPR. It is therefore necessary to refer the matter to the Court of 
Justice of the European Union pursuant to Article 267 of the Treaty on the 
Functioning of the European Union and, pending a ruling from the Court of 
Justice, to stay the proceedings relating to the application lodged by the applicant 
association. 
DECIDES AS FOLLOWS: 
MOUSSE 
 
7 
[…] The proceedings on the application lodged by the association Mousse shall be 
stayed pending a ruling by the Court of Justice of the European Union on the 
following questions: 
1. In order to assess whether data collection is adequate, relevant and limited to 
what is necessary, within the meaning of Article 5(1)(c) of the GDPR and the 
need for processing in accordance with Article 6(1)(b) and (f) of that regulation, 
may account be taken of commonly accepted practices in civil, commercial and 
administrative communications, with the result that the collection of data relating 
to customers’ civil titles, which is limited to ‘Mr’ or ‘Ms’, may be regarded as 
necessary, without this being precluded by the principle of data minimisation? 
2. In order to assess the need for the compulsory collection and processing of 
data relating to customers’ civil titles, even though some customers consider that 
they do not come under either of the two civil titles and that the collection of such 
data is not relevant in their case, should account be taken of the fact that those 
customers may, after having provided those data to the data controller in order to 
benefit from the service offered, exercise their right to object to the use and 
storage of those data by relying on their particular situation, in accordance with 
Article 21 of the GDPR? 
[…]