CE - 452850
From GDPRhub
| CE - 452850 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1)(b) GDPR Article 6(1)(f) GDPR Article 13 GDPR |
| Decided: | 31.07.2025 |
| Published: | 31.07.2025 |
| Parties: | Association Mousse SNCF Connect Commission Nationale de l'Informatique et des Libertés (CNIL) |
| National Case Number/Name: | 452850 |
| European Case Law Identifier: | ECLI:FR:CECHR:2025:452850.20250731 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | French French |
| Original Source: | Conseil d'État (in French) Press release (in French) |
| Initial Contributor: | ap |
The Court decided that an online platform for rail tickets could not rely on contract or legitimate interest to require passengers to disclose their gender (“Mr” or “Ms”), following the CJEU's decision in Mousse.
English Summary
Facts
Association Mousse (referred to as “Mousse”) filed a complaint with the DPA against SNCF Connect (a platform allowing people to purchase rail travel documents, the controller). The controller required data subjects to choose between “Mr” or “Ms” when purchasing tickets on its website. Mousse argued that this was unlawful under Article 5(1)(a) GDPR, as the controller did not have a legal basis to process this data. In addition, requiring this information violated the principle of data minimisation (Article 5(1)(c) GDPR), as well as the controller’s transparency obligations (Article 13 GDPR).
The DPA dismissed the complaint, stating that the controller had not violated the GDPR. Furthermore, the controller had a valid legal basis to process data subject’s genders under necessity for the performance of a contract (Article 6(1)(b) GDPR). Finally, processing this data complied with the principle of data minimisation, as addressing data subjects in a personalised manner was an accepted practice in commercial, civil and administrative communications.
Mousse appealed the decision to the Court, arguing that an accepted practice does not mean it is necessary for the performance of a contract. Furthermore, the obligation to disclose one’s gender is a violation of the right to respect for private life, and risked potential discrimination against the data subject. The Court decided to stay its proceedings and refer a preliminary question to the CJEU. In its decision (C-394/23 Mousse), the CJEU found that the generalised processing of passengers’ genders was not necessary for the performance of a contract or for the legitimate interest of personalised commercial communication.
Following the CJEU decision, Mousse requested the Court to issue guidelines regarding the issue, and argued that the CJEU decision implied the DPA decision should be overturned. The controller requested the Court to clarify whether it could still process the data for specific services, or offer a choice other than “Mr” and “Ms”.
Holding
The Court first stated that the processing of data subjects’ genders was not necessary for the performance of a contract, in accordance with the reasoning by the CJEU. The Court also noted that while national laws such as the Transport Code require passengers to present a document verifying their identity, it is unclear that an absence of a gender would make it more difficult to identify the passenger. Finally, offering specific services such as compartments reserved for women did not justify processing data related to a person’s gender.
The Court also stated that the controller did not need to process the data subjects’ genders to send them personalised commercial communication, as the communications could have been carried out without this data. Therefore, the controller could not rely on legitimate interest (Article 6(1)(f) GDPR), as it did not meet the necessity requirement.
The Court saw no need to assess whether the data subject had the right to object to the processing of their gender.
The Court overturned the decision of the DPA, and ordered the State to pay €3,000 to Mousse.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Council of State No. 452850 ECLI:FR:CECHR:2025:452850.20250731 Unpublished in the Lebon collection 10th - 9th joint chambers Mr. Bruno Delsol, rapporteurDESHOULIERES, lawyersReading of Thursday, July 31, 2025FRENCH REPUBLICIN THE NAME OF THE FRENCH PEOPLEHaving regard to the following procedure:By a decision of June 21, 2023, the Council of State, ruling on the litigation on the application of the MOUSSE association seeking the annulment for excess of power of the decision of March 23, 2021 by which the National Commission for Information Technology and Civil Liberties rejected its complaint against the company responsible for the OUI.sncf website, stayed the proceedings until the Court of Justice of the European Union has ruled on the following questions: 1°) Can account be taken, in assessing the adequacy, relevance and limitation to what is necessary of the collection of data within the meaning of the provisions of c) of paragraph 1 of Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27 2016, relating to the protection of natural persons with regard to the processing of personal data and on the free movement of such data, known as "GDPR", and the necessity of their processing within the meaning of b) and f) of paragraph 1 of Article 6 of the GDPR, commonly accepted practices in civil, commercial and administrative communications, so that the collection of data relating to the civility of customers, limited to the mentions "Mr" or "Ms", could be considered necessary, without hindering the principle of data minimization '2°) Is it necessary, in order to assess the necessity of the mandatory collection and processing of data relating to the civility of customers, and when certain customers consider that they do not fall under either of the two civilities and that the collection of this data is not relevant as far as they are concerned, to take into account that they could, after having provided this data to the data controller in order to benefit from the proposed service, exercise their right to object to its use and its conservation, asserting their particular situation, pursuant to Article 21 of the GDPR. By judgment C-394/23 of January 9, 2025, the Court of Justice of the European Union ruled on these questions. Having regard to the other documents in the case, including those referred to in the decision of the Council of State of June 21, 2023; Having regard to: - the Constitution, in particular its Preamble; - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - the Treaty on European Union; - the Treaty on the Functioning of the European Union; - the Charter of Fundamental Rights of the European Union; - Regulation (EU) No. 2016/679 of the European Parliament and of the Council of April 27, 2016; - the Transport Code; - Law No. 78-17 of January 6, 1978; - Judgment C-394/23 of 9 January 2025 of the Court of Justice of the European Union; - The Code of Administrative Justice; Having heard in open session:- the report of Mr. Bruno Delsol, Councillor of State, - the submissions of Ms. Esther de Moustier, public rapporteur; The floor having been given, after the submissions, to SCP Sevaux, Mathonnet, lawyer for the CNIL, and to SCP Gatineau, Fattaccini, Rebeyrol, lawyer for SNCF Connect;Considering the following:1. The MOUSSE association, an agent of individuals, has filed a complaint with the French Data Protection Authority (CNIL) against the company SNCF Voyageurs, which was subsequently succeeded by the company OUI.sncf and is now the company SNCF Connect, on the grounds that the conditions under which customers' civility was collected and recorded when purchasing train tickets, season tickets and discount cards on the company's website or applications violated certain provisions of Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, known as the "GDPR". By letter dated March 23, 2021, the CNIL informed the association that it considered that the facts alleged against the company did not constitute breaches of the invoked provisions of the GDPR and that, consequently, it was closing the complaint. The MOUSSE association requests the annulment of this decision and also submits conclusions for the purposes of an injunction and an administrative fine against the company SNCF Connect. 2. Under the terms of Article 8 of the law of 6 January 1978 relating to information technology, files and freedoms: "I.- The National Commission for Information Technology and Freedoms is an independent administrative authority. It is the national supervisory authority within the meaning and for the application of Regulation (EU) 2016/679 of 27 April 2016. It carries out the following missions:/ (...) 2° It ensures that the processing of personal data is carried out in accordance with the provisions of this law and other provisions relating to the protection of personal data provided for by legislative and regulatory texts, European Union law and France's international commitments. In this capacity:/ (...) d) It handles claims, petitions and complaints submitted by a data subject or by an organization, organization or association, examines or investigates the subject of the complaint, to the extent necessary, and informs the author of the complaint of the progress and the outcome of the investigation within a reasonable time, in particular if further investigation or coordination with another supervisory authority is necessary (...) ". 3. It follows from the provisions mentioned in point 2 that it is up to the National Commission for Information Technology and Civil Liberties (CNIL) to examine, when it receives a complaint or claim concerning the implementation of its powers, the facts that gave rise to it and to decide on the follow-up to be given to them. To this end, it has a wide discretion and may take into account the seriousness of the alleged breaches with regard to the legislation or regulations that it is responsible for enforcing, the seriousness of the evidence relating to these facts, the date on which they were committed, the context in which they were committed and, more generally, all the general interests for which it is responsible. The author of a complaint may refer to the judge for abuse of power the CNIL's refusal to follow it up. It is up to the judge to censure the latter, if necessary, on grounds of external illegality and, on the merits of the decision, in the event of an error of fact or law, a manifest error of assessment or an abuse of power. However, when the author of the complaint relies on the failure by a data controller to comply with the rights guaranteed by law to the data subject with regard to their personal data, in particular the rights of access, rectification, erasure, limitation and opposition mentioned in Articles 49, 50, 51, 53 and 56 of the law of 6 January 1978 relating to information technology, files and freedoms, the CNIL's discretionary power to decide on the follow-up to be given is exercised, having regard to the nature of the individual right in question, under the full control of the judge of excess of power. 4. It appears from the documents in the file that the MOUSSE association is requesting the annulment for abuse of power of the decision of March 23, 2021 by which the president of the CNIL closed its complaint relating to the conditions of collection and processing of the civility of its customers by the company OUI.sncf, now SNCF Connect.5. Under Article 5 of the GDPR: "1. Personal data must be: a) processed lawfully, fairly and in a transparent manner with regard to the data subject (...); c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; d) accurate and, where necessary, kept up to date; all reasonable steps must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay." According to its Article 6: "1. Processing shall be lawful only if and to the extent that at least one of the following conditions is met: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) processing is necessary to protect the vital interests of the data subject or of another natural person; e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data." personal data, in particular when the data subject is a child./ Point (f) of the first paragraph does not apply to processing carried out by public authorities in the performance of their duties. " Article 13 of the GDPR imposes an obligation on the controller to inform any person whose personal data is collected.Finally, Article 21 gives the data subject the right to object at any time, for reasons relating to their particular situation, to processing based on Article 6, paragraph 1, point f).6. In the context of the complaint it sent to the CNIL, the MOUSSE association argued that, in order to purchase a train ticket, a season ticket or a discount card online on the website or the application "OUI.sncf", now SNCF Connect, customers had to indicate their title, having the choice between only two options, "Mr" or "Ms". According to her, such data processing is not lawful, within the meaning of Article 5(1)(a) of the GDPR, because it is not based on any of the grounds provided for in Article 6(1), it disregards the principles of minimisation of data collection and accuracy also provided for in Article 5(1)(c) and (d) and, finally, SNCF does not comply with the transparency and information requirements implied by Article 5(1)(a) and Article 13. She argued that the company should not collect such data or should, at the very least, offer one or more additional options, such as "neutral" or "other". 7. The provisions of the GDPR, combined with the right to privacy, do not, in themselves, prevent the processing of data relating to a person's civility, provided, however, that the processing meets one of the conditions of lawfulness mentioned in paragraph 1 of Article 6 of the GDPR and the principles of necessity and minimization which arise from Article 5. In deciding to close the complaint submitted to it, the CNIL, on the one hand, noted that, in the context of the provision of transport services by the company, the contract concluded with its client constituted the legal basis for the processing. Thus, among the different legal bases provided for by paragraph 1 of Article 6 of the GDPR, it considered that the disputed processing fell under that provided for in b), according to which processing is lawful if it is "necessary for the performance of a contract to which the data subject is party or for the execution of pre-contractual measures taken at the request of the latter". On the other hand, it considered that the collection of the civility of customers could be considered necessary with regard to the purposes of the processing, within the meaning of c) of Article 5, and therefore as satisfying the requirement of data minimization, since addressing customers using their civility corresponds to the practices in civil, commercial and administrative communications. In defense, it argues in particular that the processing of civility could also be considered necessary for the purposes of the legitimate interests pursued by SNCF Connect within the meaning of f) of 1 of Article 6 and that the persons concerned could, depending on their particular situation, assert the right to object guaranteed to them by Article 21. On the legal basis provided for in b) of 1 of Article 6 of the GDPR, relating to the performance of a contract: 8. Firstly, by judgment C-394/23 of 9 January 2025 ruling on the questions referred to it by the Council of State ruling on litigation for a preliminary ruling in the present dispute, the Court of Justice of the European Union ruled that the processing of personal data relating to the civility of customers of a transport company, the purpose of which is to personalize commercial communication based on their gender identity, does not appear objectively indispensable or essential in order to allow the correct performance of a contract and, therefore, cannot be considered necessary for the performance of this contract. 9. Secondly, under the terms of Article L. 2224-11 of the Transport Code, "Road, rail or guided transport companies may make the journey of their passengers subject to the possession of a personal transport ticket. In this context, the passenger is required, when the transport company requests it, to present a document attesting to his identity so that the concordance between this and the identity mentioned on his transport ticket can be verified." However, it does not appear from the documents in the file that the absence of the mention of the civility "Mr" or "Ms" on the transport ticket would be likely to make the identification of the passenger more difficult. 10. Thirdly, although SNCF Connect argues that the processing of data relating to the person's gender may be considered essential for services such as bookings on night trains offering couchette services in compartments reserved for single women, such a circumstance, as the Court of Justice of the European Union noted in its aforementioned judgment, did not justify requiring the mention of civility for all the services at issue in this dispute. On the legal basis provided for in Article 6(1)(f) of the GDPR, relating to the legitimate interests of the data controller:11. By its judgment of 9 January 2025 already mentioned, the Court of Justice of the European Union ruled that the processing of personal data relating to the civility of customers of a transport company, for the purpose of personalising commercial communication based on their gender identity, cannot be considered necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where the legitimate interest pursued was not indicated to those customers when the data was collected, or where the processing is not carried out within the limits of what is strictly necessary to achieve that legitimate interest, or where, in the light of all the relevant circumstances, the fundamental rights and freedoms of customers are likely to prevail over the legitimate interest pursued, in particular due to a risk of discrimination based on gender identity. 12. While it is true that the processing of "Mr" or "Ms" data enables the company to address the person in the usual manner, in accordance, no doubt, with the expectations of a significant proportion of its customers, such a result could also have been achieved, without disregarding the requirements set by the GDPR and recalled in point 5, by offering customers the option of indicating their title in an optional and non-mandatory manner. For the reasons set out in point 9, the processing in dispute could not be justified, in this case, by the interest in identifying passengers. For the reasons set out in point 10, the interest in performing certain specific services offered by SNCF Connect could not justify the entire contested processing. Consequently, this processing could not be regarded as remaining within the limits of what is strictly necessary for the achievement of a legitimate interest, without it being necessary to rule on the two other conditions which arise from f) of 1 of Article 6. On the taking into account of the right to object: 13. By its judgment of 9 January 2025 already mentioned, the Court of Justice of the European Union ruled that f) of 1 of Article 6 of the GDPR must be interpreted as meaning that, in order to assess the necessity of processing personal data under this provision, there is no need to take into consideration the possible existence of a right of objection of the data subject, under Article 21 of this regulation. 14. It follows from all of the above that the CNIL could not legally close the complaint of the MOUSSE association on the grounds that the mandatory collection of the addresses "Mr" or "Ms", as imposed on the date of its decision, was necessary for the performance of the contract concluded between the company SNCF Connect and its customer, within the meaning and for the application of paragraph 1, b), of Article 6 of the GDPR, and that its decision could not be based on the legitimate interest of the data controller provided for in f) of the same 1 nor on taking into account the right of objection guaranteed by Article 21. 15. Consequently, without there being any need to examine the other grounds of the application, the MOUSSE association is justified in arguing that the decision by which the CNIL closed the complaint that it had filed on behalf of natural persons must be annulled. It is up to the CNIL, which has been re-informed of the complaint by virtue of this cancellation, to assess whether and to what extent it should make use of the powers granted to it by Articles 20 to 23, relating to corrective measures and sanctions, of the law of 6 January 1978 relating to information technology, files and freedoms, which allow it in particular to issue an injunction to a data controller or its subcontractor, or to impose a fine on it. It follows that the conclusions presented by the applicant association for the purposes of an injunction and a fine against the company SNCF Connect can only be rejected. Finally, in the circumstances of this case, it is appropriate to award the State €3,000 in compensation, pursuant to Article L. 761-1 of the French Code of Administrative Justice. DECIDES: -------------- Article 1: The decision of March 23, 2021, by which the French National Commission for Information Technology and Civil Liberties closed the complaint filed by the MOUSSE association, is annulled. Article 2: The State shall pay the MOUSSE association €3,000 in compensation pursuant to Article L. 761-1 of the French Code of Administrative Justice. Article 3: The remaining submissions in the application are dismissed. Article 4: This decision shall be notified to the MOUSSE association, the French National Commission for Information Technology and Civil Liberties, and SNCF Connect. Deliberated at the end of the session of July 2, 2025, which was attended by: Mr. Christophe Chantepy, President of the Litigation Section, presiding; Mr. Bertrand Dacosta, Ms. Anne Egerszegi, Chamber Presidents; Mr. Olivier Yeznikian, Ms. Rozen Noguellou, Mr. Nicolas Polge, Mr. Vincent Daumas, Mr. Jérôme Goldenberg, State Councilors; and Mr. Bruno Delsol, State Councilor-Rapporteur. Delivered on July 31, 2025. The President: Signed: Mr. Christophe Chantepy The Rapporteur: Signed: Mr. Bruno Delsol The Secretary: Signed: Ms. Magali Méaulle
