62023CJ0394_RES
Case C‑394/23
MOUSSE
v
Commission nationale de l’informatique et des libertés (CNIL) and Others
(Request for a preliminary ruling from the Conseil d’État (France))
Judgment of the Court (First Chamber) of 9 January 2025
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Conditions governing the lawfulness of the processing of personal data – Principle of data minimisation – Processing necessary for the performance of a contract binding on the data subject – Concept – Collection, by a transport undertaking, of data relating to the title and gender identity of its customers for the purposes of personalising commercial communication – Precluded
(European Parliament and Council Regulation 2016/679, Arts 5(1)(c) and 6(1), first subpara., point (b))
(see paragraphs 22-29, 33, 34, 36-40, 42, 43, 64, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Conditions governing the lawfulness of the processing of personal data – Principle of data minimisation – Processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party – Concept – Collection, by a transport undertaking, of data relating to the title and gender identity of its customers for the purposes of personalising commercial communication – Precluded – Conditions
(European Parliament and Council Regulation 2016/679, Art. 6(1), first subpara., point (f))
(see paragraphs 22-29, 45-50, 52-64, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Scope – Concept of processing of personal data – Collection, by a transport undertaking, of data relating to the title and gender identity of its customers – Included
(European Parliament and Council Regulation 2016/679, Arts 2(1) and 4(1) and (2))
(see paragraph 30)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Conditions governing the lawfulness of the processing of personal data – Processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party – Criteria for assessment – Right to object of the person to whom the processing relates – Excluded
(European Parliament and Council Regulation 2016/679, Arts 6(1), first subpara., point (f), and 21)
(see paragraphs 66-70, operative part 2)
Résumé
Having received a request for a preliminary ruling from the Conseil d’État (Council of State, France), the Court of Justice clarifies the scope of the principles of lawfulness and data minimisation, laid down in the GDPR, (
1
) in the context of the processing, by a transport undertaking, of data relating to its customers’ titles for the purposes of personalising its commercial communication.
SNCF Connect sells rail travel documents via its website and online applications. Its customers are required to indicate their title, by ticking ‘Monsieur’ or ‘Madame’ (‘Mr’ or ‘Ms’) when purchasing those travel documents online.
The association Mousse lodged a complaint with the Commission nationale de l’informatique et des libertés (CNIL) (French Data Protection Authority) against SNCF Connect, on the ground that the conditions for collecting and recording data relating to the titles of SNCF Connect’s customers did not comply with the requirements of the GDPR. More specifically, Mousse alleged that the collection of those data by SNCF Connect infringed the principles of lawfulness and data minimisation as well as the obligations of transparency and provision of information arising from that regulation. (
2
)
By decision of 23 March 2021, the CNIL decided that the data processing carried out by SNCF Connect was lawful, on the ground that it was necessary for the performance of the relevant contract (
3
) for the provision of transport services and that it was consistent with the principle of data minimisation.
On 21 May 2021, Mousse brought an action before the referring court seeking annulment of the CNIL’s decision, claiming that the obligation imposed on SNCF Connect’s customers to indicate their title was not necessary for the performance of a contract for the provision of transport services, that it was liable to infringe, inter alia, the right to respect for private life and that it gave rise to a risk of discrimination on grounds of gender identity.
In that context, the referring court asks whether, in order to assess the need for SNCF Connect’s collection of data relating to its customers’ titles, account may be taken, first, of commonly accepted practices in commercial, civil and administrative communications and, second, of the fact that those customers could, after providing those data to the controller, exercise their right to object to the use of such data, for reasons relating to their particular situation. (
4
)
Findings of the Court
In the first place, the Court examines whether the processing of personal data relating to the title of customers of a transport undertaking, the purpose of which is to personalise the commercial communication, may be regarded as necessary for the performance of a contract (
5
) or for the purposes of the legitimate interests pursued by the controller or by a third party. (
6
)
As regards, first, the need for such processing for the performance of a contract, (
7
) the Court states that it must be objectively indispensable to achieve a purpose forming an integral part of the performance of the contract. More specifically, such processing must be essential for the proper performance of the contract concluded between the controller and the data subject and, therefore, there must be no other workable and less intrusive solutions.
In the present case, given that the main subject matter of the transport contract in question is the provision of a rail transport service to customers and that the purpose of the data processing at issue in the main proceedings is to personalise the commercial communication with the customer, that communication may constitute a purpose forming an integral part of the performance of the contract. The provision of such a service involves, in principle, communicating with the customer in order, inter alia, to send him or her a travel document by electronic means, to inform him or her of any changes affecting the corresponding journey and to enable exchanges with after-sales service. Such communication may require adherence to accepted practices and may include, in particular, forms of addressing a customer, in order to show that the undertaking respects him or her.
However, the Court points out that such communication does not necessarily have to be personalised according to the gender identity of the customer concerned. In the present case, as regards the services in question in the main proceedings, personalised commercial communication, based on a presumed gender identity according to a customer’s title, does not appear to be objectively indispensable or essential in order to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for its performance. A workable and less intrusive solution seems to exist, since SNCF Connect could choose, with regard to customers who do not wish to indicate their title or in general, to communicate based on generic, inclusive expressions when addressing those customers, with no correlation to the latter’s presumed gender identity.
As regards, second, the need to process the personal data relating to the title of the customers of a transport undertaking for the purposes of the legitimate interests pursued by the controller or by a third party, (
8
) the Court reiterates, first of all, the three conditions to be met in order for such processing to be lawful.
As regards, first, the condition relating to the pursuit of a legitimate interest by the controller or by a third party, the Court points out that it is for the controller to indicate to the person whose personal data it collects the legitimate interests which the controller pursues during the processing in question. Such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client of the controller.
In the present case, the Court indicates that it is for the referring court to ascertain whether SNCF Connect informed its customers (
9
) of a legitimate interest and states that the processing of personal data for the purposes of direct commercial marketing may serve a legitimate interest. In particular, in such a context, personalised advertising may be equated with commercial marketing.
As regards, second, the condition relating to the need for the processing of personal data for the attainment of the legitimate interest pursued, the Court explains that it must be examined in conjunction with the principle of data minimisation. (
10
) Thus, it is for the referring court to ascertain whether the legitimate interest pursued by the processing of the data can reasonably be achieved just as effectively by other means less restrictive of the fundamental freedoms and rights of data subjects. In the present case, it appears that personalised commercial communication can be limited to the processing of customers’ surnames and forenames, since their title and/or gender identity are not information that is strictly necessary in that context, in particular in the light of the principle of data minimisation. In that context, the Court states that, although the GDPR (
11
) does not provide for the accepted practices and social conventions specific to each Member State to be taken into account for the purposes of assessing whether the processing of personal data is necessary, it is open to the controller to adhere to those practices and social conventions. That controller could use, vis-à-vis customers who do not wish to indicate their title or in general, generic, inclusive expressions when addressing those customers, with no correlation to their gender identity.
As regards, third, the condition that the interests or fundamental freedoms and rights of the data subject do not take precedence over the legitimate interest of the controller or of a third party, the Court considers that that condition entails a balancing of the opposing rights and interests involved. It is for the national court concerned to carry out that balancing exercise by taking into account, inter alia, the reasonable expectations of the data subject, the extent of the processing concerned and the impact of that processing on that data subject. In the present case, subject to verification by the referring court, a customer of a transport undertaking is not supposed to expect that undertaking to process data relating to his or her title or gender identity in the context of the purchase of a travel document. That would be the case, in particular, if that processing were carried out solely for direct commercial marketing purposes. However, the Court states that the legitimate interest relating to direct commercial marketing cannot, in any event, prevail where there is a risk that the fundamental freedoms and rights of the person concerned will be infringed. It is thus for the national court to determine whether there is a risk of discrimination on grounds of gender identity, as claimed by Mousse, in particular in the light of Directive 2004/113. (
12
) The Court adds, in that regard, that the scope of that directive cannot be confined simply to discrimination based on the fact that a person is of one or other gender. In view of its purpose and the nature of the rights which it seeks to safeguard, that directive also applies to discrimination arising from a change in a person’s gender identity.
In the light of the foregoing, the Court concludes that the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where the undertaking did not inform those customers of the legitimate interest pursued when those data were collected, where the processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest, or where, in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
In the second place, the Court examines whether, in order to assess the need for the processing of personal data relating to the title of customers of a transport undertaking for the purposes of the legitimate interests pursued by the controller or by a third party, account must be taken of the possible existence of a right of the data subject to object. (
13
) The possible existence of a right to object presupposes the existence of lawful processing, based in the present case on the legitimate interests pursued by the controller or by a third party. In order to be lawful, such processing must first satisfy the condition of strict necessity for the legitimate interest pursued. It thus follows from the wording and scheme of the provisions of the GDPR that the existence of a right to object cannot be taken into consideration for the purposes of assessing lawfulness and, in particular, the need to process personal data based on the legitimate interests pursued by the controller or by a third party.
(
1
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), Article 5(1)(a) and (c).
(
2
)	Article 13 of the GDPR.
(
3
)	Point (b) of the first subparagraph of Article 6(1) of the GDPR.
(
4
)	Article 21 of the GDPR.
(
5
)	Point (b) of the first subparagraph of Article 6(1) of the GDPR.
(
6
)	Point (f) of the first subparagraph of Article 6(1) of the GDPR.
(
7
)	Point (b) of the first subparagraph of Article 6(1) of the GDPR provides that the processing of personal data is lawful if it is ‘necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.
(
8
)	Point (f) of the first subparagraph of Article 6(1) of the GDPR provides that the processing of personal data is lawful if it is ‘necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.
(
9
)	Under Article 13(1)(d) of the GDPR, the controller of personal data is under an obligation to inform data subjects directly of the legitimate interest pursued when the personal data is collected.
(
10
)	Under Article 13(1)(d) of the GDPR, the controller of personal data is under an obligation to inform data subjects directly of the legitimate interest pursued when the personal data is collected.
(
11
)	Point (f) of the first subparagraph of Article 6(1) of the GDPR.
(
12
)	Council Directive 2004/113/EC of 13 December 2004 implementing the principle of equal treatment between men and women in the access to and supply of goods and services (OJ 2004 L 373, p. 37).
(
13
)	Under Article 21 of the GDPR, the data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of the first subparagraph of Article 6(1) of the GDPR, including profiling based on those provisions.