CE - FR:CECHS:2025:492344.20251128
| CE - FR:CECHS:2025:492344.20251128 | |
|---|---|
 | |
| Court: | CE (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 5(1)(e) GDPR Article 5(1)(f) GDPR Article 5(1)(c) GDPR Article 6(1)(e) GDPR Article 9(1) GDPR Article 12 GDPR Article 21 GDPR Article 23 GDPR Arrêté du 19 décembre 2023 Article 14 ECHR Article 8 ECHR Décret 2019-341 Décret 2023-971 French Civil Code Articles 60, 61 and 61-3-1 |
| Decided: | 07.10.2025 |
| Published: | 28.11.2025 |
| Parties: | Conseil d'Etat Ligue des droits de l'Homme |
| National Case Number/Name: | FR:CECHS:2025:492344.20251128 |
| European Case Law Identifier: | ECLI:FR:CECHS:2025:492344.20251128 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | French |
| Original Source: | Légifrance (in French) |
| Initial Contributor: | Orla Harris |
The Supreme Administrative Court dismissed the claim that the Minister of the Interior unlawfully ordered the automatic creation of a table with the personal data of people who completed the procedure of changing their name.
English Summary
Facts
The law of 2 March 2022 had introduced Article 61-3-1 of the Civil Code, which created a simplified procedure to change one’s surname in France. This reform led to an increase in name changes, which were only registered in civil status registers and not in administrative databases. In response, the French Ministry of the Interior adopted, on 19 December 2023, an Order creating an automated table called “table of correspondence of first and family name”. This table relied on eight categories of information: first name and family name before and after the change, the place and date of birth, the date of the change of name, the gender and, where applicable, the parental link (filiation).
On 4 March 2024, the Ligue des droits de l'Homme (LDH) brought a case to the supreme administrative Court against the Minister of the Interior regarding its Order of 19 December 2023, with additional claims filed on 4 June 2024.
Issues under the GDPR
Firstly, the LDH contended that the processing revealed special categories of personal data within the meaning of Article 9 GDPR. Secondly, it submitted that Article 6(1)(e) GDPR was breached because no sufficiently defined public interest task justified the processing. Thirdly, LDH relied on Article 5(1)(c) GDPR, claiming that the scope of data collected, particularly sex and parental link (filiation), was not limited to what was necessary for the purposes put forward by the State. Fourthly, invoking Article 5(1)(f) GDPR, it maintained that there was a risk of uncontrolled dissemination of the data in view of the potentially large number of services and agents authorised to access the table.
Fifthly, under Article 5(1)(e) GDPR, it argued that the principle of storage limitation was not respected, on the basis that the six-year retention period for the personal data was excessive while the three-year retention period for logging data was insufficient. Sixthly, LDH claimed a breach of Article 12 GDPR, asserting that data subjects were not adequately informed about the processing. Seventhly, it relied on Article 21 GDPR and Article 23 GDPR to challenge what it considered an unjustified restriction of the right to object to this personal data processing.
Issues under the ECHR
Its next claimed a violation of Articles 8 and 14 ECHR. Alleging, on the one hand, that the interference with private life caused by the processing was neither necessary nor proportionate (Article 8 ECHR) and, on the other, that the scheme directly or indirectly discriminated against transgender persons and persons of foreign origin. In particular those seeking to “Francise” their names (Article 14 ECHR).
Other issues
Firstly, it argued that the Secretary-General of the Ministry of the Interior was not competent to sign the Order. Secondly, it argued that the Order of 19 December 2023 was illegal by way of consequence, since the Decree of 20 October 2023 on which it was based was itself allegedly unlawful on the same ECHR and GDPR grounds.
Based on the above, the LDH asked the French state to do two things. First, to cancel the Order of 19 December 2023 because of an excess of power exercised to create it. Second, to fine the State an administrative sum of 4’000 EUR under L. 761-1 of the Code of Administrative Justice (litigation costs).
Holding
On 28 November 2025, the Supreme Administrative Court rejected the entirety of LDH's claims.
Competence
The Court held that the Secretary-General of the Ministry of the Interior, who was responsible for matters relating to data-processing regulation, had competence to sign the Order.
Articles 8 and 14 ECHR
The Court held that the processing pursued legitimate aims linked to the accuracy, reliability and maintenance of the Ministry’s files, and therefore did not breach Article 8 ECHR. It further held that the Order applied in the same way to all persons who had changed their name, regardless of whether they were transgender or of foreign origin, and therefore did not amount to discrimination under Article 14 ECHR.
The Court found that the categories of information in the table did not reveal special categories of personal data within the meaning of Article 9 GDPR and therefore did not constitute sensitive data under that provision.
Article 6(1)(e) GDPR
The Court held that the processing was necessary to perform a task carried out in the public interest within the meaning of Article 6(1)(e), namely securing and updating identity data in the information systems of the Ministry of the Interior.
Illegality
The Court rejected the argument that the Decree of 20 October 2023 was illegal and held that it could validly serve as the legal basis for the Order of 19 December 2023.
Article 5(1)(c) GDPR
The amount of data collected was necessary to prevent cases of homonym and was therefore adequate, relevant and necessary to ensure the correct identification of persons whose names changed.
Article 5(1)(f) GDPR
Access to the table was restricted to agents acting within their duties and on a specific need-to-know basis.
Article 5(1)(e) GDPR
The six year retention period was justified by the manual nature of updating the table. Further, the three year log retention was not too short as the GDPR does not require logs to be stored as long as the main data.
The Court held that the fact that the Order of 19 December 2023 did not expressly restate the right to information under Article 12 GDPR did not prevent data subjects from exercising that right.
Articles 21 and 23 GDPR
Restricting the right to object is permitted if it; firstly is necessary and proportionate and secondly, is pursuing objectives of important public interest. The Court deemed it was justified to restrict because the measure secured the use of identity based processing systems of the MoI as well as protected data subjects and third parties through reliable and updated identity-related data. Therefore, it was necessary and proportionate.
Regarding costs, the State was not the losing party and therefore was not ordered to pay the 4’000 EUR litigation costs the LDH requested.
Comment
This was a very complex case as what is presented as a case of transgender and foreign national discrimination is a 10 layer complaint. Given the MoI’s explanation to each claim, it seems this case could have been partially prevented if the MoI had been more transparent with their aim and goals for this legislation.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Full text FRENCH REPUBLIC IN THE NAME OF THE FRENCH PEOPLE Having regard to the following procedure: By a summary application and a supplementary memorandum, registered on March 4 and June 4, 2024, respectively, with the Registry of the Litigation Division of the Council of State, the association La Ligue des droits de l'homme (The League of Human Rights) requests the Council of State: 1) to annul for abuse of power the Order of December 19, 2023, establishing an automated processing of personal data called the "surname and first name correspondence table"; 2) to order the State to pay the sum of €4,000 pursuant to Article L. 761-1 of the Code of Administrative Justice. Having regard to the other documents in the file; Having regard to: - the European Convention for the Protection of Human Rights and Fundamental Freedoms; - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; - the Civil Code, as amended by Law No. 2022-301 of 2 March 2022; - Law No. 78-17 of 6 January 1978; - Decree No. 2005-850 of 27 July 2005; - Decree No. 2013-728 of 12 August 2013; - Decree No. 2019-341 of 19 April 2019; - Decree No. 2023-971 of 20 October 2023; - the decree of August 12, 2013, concerning the internal organization of the General Secretariat of the Ministry of the Interior; - the Code of Administrative Justice; After hearing in open court: - the report of Mr. Thomas Odinot, Master of Requests, - the submissions of Ms. Leila Derouich, Public Rapporteur; Following the submissions, the floor was given to SCP Spinosi, counsel for the League of Human Rights; Considering the following: 1. The Order of 19 December 2023 of the Minister of the Interior and Overseas Territories was issued pursuant to the provisions of point 4 of section J of Article 2 of the Decree of 19 April 2019 relating to the implementation of processing operations involving the use of the National Identification Number for Natural Persons (RNIPP) or requiring consultation of this register, introduced by Decree No. 2023-971 of 20 October 2023. It establishes an automated processing of personal data called the "surname and first name correspondence table" which concerns persons who have changed their surname or first names on the basis of Articles 60, 61 and 61-3-1 of the Civil Code. Placed under the responsibility of the Ministry of the Interior (General Secretariat), this system is populated by data extracted from the National Register of Individuals (RNIPP), which is managed by the National Institute of Statistics and Economic Studies (INSEE). This data comprises eight categories of information concerning the surname before the change of name, the surname after the change of name, the given names before the change and those after the change, the date and place of birth, the date of the change of surname and given name, the sex, and, where applicable, parentage. The purposes of this processing are, firstly, to consult the identity of individuals who have changed their surname or given name in accordance with Articles 60, 61, and 61-3-1 of the Civil Code, excluding the RNIPP registration number (NIR), and secondly, to update this identity in the personal data processing systems implemented by the Ministry of the Interior or its affiliated public institutions. The Human Rights League is requesting the annulment of this decree on the grounds of abuse of power. Regarding external legality: 2. Pursuant to the provisions of Article 1 of the decree of July 27, 2005, concerning the delegation of signature authority to members of the Government: "From the day following the publication in the Official Journal of the French Republic of the act appointing them to their positions (...) may sign, on behalf of the Minister or the Secretary of State and by delegation, all acts, with the exception of decrees, relating to the affairs of the services under their authority: / 1° The Secretaries General of the Ministries (...)." Pursuant to Article 3 of the Decree of 12 August 2013 concerning the organization of the central administration of the Ministry of the Interior and the Ministry for Overseas France, the Directorate of Public Liberties and Legal Affairs, which, pursuant to Article 10 of the Order of 12 August 2013 concerning the internal organization of the General Secretariat of the Ministry of the Interior, is responsible for regulations concerning the processing of personal data, is placed under the authority of the Secretary General of the Ministry of the Interior. Mr. A... B... was appointed Secretary General of the Ministry of the Interior and Overseas France by Decree of 11 January 2023. Therefore, he was authorized to sign, on behalf of the Minister and by delegation, the contested Order of 19 December 2023, which, by its subject matter, falls within the purview of the Directorate of Public Liberties and Legal Affairs. Consequently, the argument based on the lack of competence of the author of the contested Order must be dismissed. On domestic legality: Regarding the violation of Articles 8 and 14 of the European Convention for the Protection of Human Rights and Fundamental Freedoms with respect to the purposes of the processing: 3. The Human Rights League argues, firstly, that the serious interference with the right to respect for the private life of transgender people permitted by the processing in question is unnecessary and disproportionate to the purposes of the processing; secondly, that this processing indirectly targets transgender people and people of foreign origin, thus establishing a difference in treatment compared to the rest of the population; and finally, that, given the infringing and potentially discriminatory nature of the processing, the purposes of the processing are neither objective nor reasonable. Regarding the purposes of the processing: 4. In accordance with the provisions of point 4 of section J of Article 2 of the decree of April 19, 2019, mentioned in point 1, and according to the terms of Article 1 of the contested order, the authorized processing has the following purposes: firstly, to consult the identity of persons who have changed their surname or first name pursuant to Articles 60, 61, and 61-3-1 of the Civil Code and, secondly, to update this identity in the personal data processing systems implemented by the Minister of the Interior or the public institutions attached to him. 5. It appears from the case file that the data processing system was created following the entry into force of the provisions of the Law of 2 March 2022 concerning the choice of a surname derived from parentage, which introduced Article 61-3-1 into the Civil Code, offering a simplified procedure for changing one's surname, without prejudice to the procedure provided for in Article 61 or to the procedure, also maintained, of Article 60 concerning changes of first names. It is undisputed that this reform has led to a sharp increase in changes of identity, the transcription of which appears only in the civil registry. The Minister argues that, due to a lack of appropriate information, the Ministry of the Interior and the public institutions attached to it, which implement various processing systems based on the personal identity data of the individuals concerned, are unable to be aware of their changes of surname and first name, and that such a situation is likely to compromise the accuracy, reliability, and up-to-dateness of these files. The processing system known as the "surname and first name correspondence table," described in point 1, allows, firstly, the consultation of changes to surnames and first names after their registration in the National Register of Individuals (RNIPP), thus preventing the risk of homonymy. Secondly, it allows for the updating of these identity changes in the processing systems implemented by the Ministry of the Interior or its affiliated public institutions. It follows, on the one hand, that this consultation purpose ensures the secure use of each of the processing systems thus implemented and, on the other hand, that the updating purpose ensures compliance with the principle of accuracy and keeping data up to date guaranteed by Article 5(1)(d) of the GDPR. Each of these two purposes, which are based on an objective and reasonable criterion, is founded on a legitimate public interest. While the applicant argues that the processing is unnecessary for updating the identities of individuals in other data processing systems under the Minister's responsibility, and alleges that other, less intrusive means, which carry no risk of discrimination, could achieve the same result, she provides no evidence to support this claim. Furthermore, the case file does not indicate that the contested processing has no other objective, as the applicant alleges, than to target transgender individuals and individuals of foreign origin who have changed their surname or given names. Regarding the violation of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms: 6. Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms states: "1. Everyone has the right to respect for his private and family life, his home and his correspondence. / 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others." 7. Interference with the exercise of any person's right to respect for their private life, which constitutes the collection, storage, and processing by a public authority of personally identifiable information, can only be legally authorized if it serves legitimate purposes and if the selection, collection, and processing of the data are carried out in a manner that is appropriate and proportionate to those purposes. 8. While it is undisputed that the collection, storage, and processing by the Ministry of the Interior and its affiliated institutions of the personally identifiable information mentioned in point 1 constitutes an interference with the private life of the individuals concerned, it follows from what was stated in point 5 that this interference serves legitimate purposes. It is also clear from the case file and the provisions of the contested order that the selection, collection, and processing of this data must be carried out in a manner that is appropriate and proportionate to the aforementioned purposes. The applicant association has not demonstrated that the situation would be different for transgender people. Consequently, it is not justified in claiming that the decree violates the provisions of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. Regarding the violation of Article 14 of the European Convention for the Protection of Human Rights and Fundamental Freedoms: 9. Article 14 of the European Convention for the Protection of Human Rights and Fundamental Freedoms states: "The enjoyment of the rights and freedoms set forth in this Convention shall be secured without discrimination on any ground such as sex, race, color, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status." 10. It is clear from the wording of the decree of October 20, 2023, and the order of December 19, 2023, mentioned in point 1, that the processing in question does not, in itself, distinguish between persons who have changed their surname or first names for reasons related to their gender identity or foreign origin and other persons who have also made such changes. The documents in the file do not indicate that this processing, during the operation of consulting the processing or updating the recipient files, would necessarily have the effect of targeting, even indirectly, transgender persons who have changed their surname due to the matching of this data with data relating to sex, or persons of foreign origin who have Gallicized their first names after their naturalization. Consequently, the argument that the processing in question constitutes a discriminatory infringement of the rights of these two categories of persons, in violation of Article 14 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, must be dismissed. Regarding the sensitive nature of the data collected: 11. According to Article 9(1) of the GDPR: "The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, shall be prohibited." 12. It does not appear from the case file that, either on their own or through any intellectual process of deduction or cross-referencing, in particular by comparing data relating to changes of surname or first name with data relating to gender, the eight categories of data, mentioned in point 1, recorded in the contested processing system known as the "surname and first name correspondence table," even if they reveal a change of gender, are likely to reveal either the racial or ethnic origin of the persons concerned, or their sexual life or sexual orientation. Consequently, in the absence of any reasonable doubt as to the correct application of the provisions of Article 9 of the GDPR, and without it being necessary to refer a question concerning the interpretation of the relevant provisions of EU law to the Court of Justice of the European Union for a preliminary ruling, the applicant association is not justified in arguing that the contested order infringes those provisions. Regarding the lawfulness of the processing: 13. Pursuant to Article 6(1)(e) of the GDPR, processing is lawful, in particular, if it is necessary for the performance of a task carried out in the public interest. To argue that the decree does not specify a sufficiently precise and defined task carried out in the public interest to which the processing in question could be related, the applicant association merely refers to its previous arguments, without providing any further details to support its claim based on the alleged violation of Article 6 of the GDPR. In light of the foregoing, this claim must therefore be dismissed. Regarding the illegality of the decree of October 20, 2023: 14. The applicant association argues that the contested order is illegal due to the illegality of the decree of October 20, 2023, which, having introduced the provisions of point 4 of section J into Article 2 of the decree of April 19, 2019 mentioned in point 1, constitutes its legal basis. In support of this plea of illegality, it relies on the same arguments that have just been dismissed. It follows that this plea of illegality must be dismissed. Regarding the other provisions of the contested order: Concerning the principle of data minimization: 15. Pursuant to the principle of data minimization established by Article 5(1)(c) of the GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes for which they are processed. 16. Articles 1 and 2 of the contested decree stipulate that the Minister of the Interior implements an automated personal data processing system, called a "surname and first name correspondence table," whose purpose is to consult this identity using the eight categories of personal data listed in point 1, and to update this data in the personal data processing systems under the Ministry and its affiliated public institutions. Given the potential for cases of homonymy and to mitigate the resulting risks to individuals' rights, this data, including, in particular, gender and, where applicable, parentage data, appears adequate, relevant, and limited to what is necessary to accurately identify a natural person, taking into account their change of surname or first name. Consequently, the argument, moreover stated without further details, based on a violation of the principle of data minimization, must be dismissed. Regarding data security and confidentiality: 17. According to Article 5 of the GDPR: "1. Personal data shall be: (...) / (f) processed in a manner which ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality)." 18. It is clear from the wording of Article 4 of the contested decree that the agents mentioned therein are only authorized to access all or part of the data in question "by virtue of their duties and to the extent necessary to know." The documents in the file do not indicate that the number of departments, units, prefectures, and sub-prefectures mentioned in the decree, nor the number of agents within them who may be specifically designated and authorized as accessors, would be sufficient to establish that the processed data is subject to an insufficient level of security and confidentiality. Consequently, the argument that the provisions of Article 4 of the decree give rise to concerns about the uncontrolled dissemination of files, in disregard of the data security and confidentiality requirements, must be dismissed. Regarding the retention period for the collected data: 19. Pursuant to the principle of "storage limitation" mentioned in Article 5(1)(e) of the GDPR, the personal data collected must be kept for no longer than is necessary for the purposes for which they are processed. It appears from the case file that the six-year data retention period stipulated in Article 3 of the contested decree is justified by the purpose of updating the recipient data processing systems, particularly given the manual nature of this operation, pending the implementation of an automated update procedure. Consequently, since this period does not exceed that necessary for this purpose, the argument that the decree violated Article 5 of the GDPR on this point must be dismissed. Regarding the retention period for log data: 20. Pursuant to Articles 24 and 30 of the GDPR, each data controller shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that processing is carried out in accordance with the Regulation and shall maintain a record of processing activities. No principle of data protection law prohibits retaining information relating to data processing operations for a shorter period than the retention period for the data itself, taking into account their respective purposes. The three-year period for which access and action records are kept does not appear insufficient in this case. Consequently, the argument based on the illegality of the three-year period stipulated in Article 6 of the decree must be dismissed. Regarding compliance with the right to information: 21. On the one hand, according to Article 12(1) of the GDPR: "The controller shall take appropriate measures to provide the data subject with any information referred to in Articles 13 and 14 and any communication pursuant to Articles 15 to 22 and Article 34 concerning the processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information specifically intended for a child (...)." 22. No provision of the contested order, which was not required to reiterate those cited in the preceding point, precludes the controller's obligation to take appropriate measures to provide the data subject with any information under the conditions laid down in Article 12 of the GDPR. Consequently, the argument that the contested order infringes the right to information must be dismissed. Regarding the removal of the right to object: 23. Article 21 of the GDPR, to which Article 56 of the Law of 6 January 1978 refers, provides that the right to object does not apply when the processing is necessary to comply with a legal obligation or, under the conditions laid down in Article 23 of the same Regulation, when the application of these provisions has been expressly excluded by a provision of the instrument establishing the processing. Paragraph 1 of Article 23 of the GDPR authorizes national authorities to limit the scope of the right to object "where such a limitation respects the essence of fundamental rights and freedoms and is necessary and proportionate in a democratic society to ensure: (...) / (i) the protection of the data subject or of the rights and freedoms of others." It follows from these provisions that the regulatory act authorizing the implementation of personal data processing or specifying the procedures for personal data processing established by law may include an express provision excluding the exercise of the right to object, provided that such exclusion is necessary and, particularly in light of the nature of the data, the purposes pursued, and the safeguards in place, proportionate to achieving important objectives of public interest. 24. Given the public interest objective of ensuring the secure use of each processing operation under the jurisdiction of the Ministry of the Interior and its affiliated public institutions, with regard to their specific purposes, through the use of secure and up-to-date identity data, such a restriction of the right to object constitutes a necessary and proportionate measure intended to guarantee the protection of the data subject or the rights and freedoms of others. Consequently, the argument based on the unjustified nature of this limitation of the right to object must be dismissed. 25. It follows from all the foregoing that the League for Human Rights is not entitled to seek the annulment of the order it is challenging. Therefore, its claims must be dismissed, including those submitted under Article L. 761-1 of the Code of Administrative Justice. DECIDES: Article 1: The application of the League for Human Rights is dismissed. Article 2: This decision will be notified to the League for Human Rights and to the Minister of the Interior. Deliberated at the close of the session of October 7, 2025, at which the following judges were present: Mr. Bertrand Dacosta, Chamber President, presiding; Mr. Olivier Yeznikian, State Councillor; and Mr. Thomas Odinot, Master of Requests-Rapporteur. Issued on November 28, 2025. The President: Signed: Mr. Bertrand Dacosta The Rapporteur: Signed: Mr. Thomas Odinot The Secretary: Signed: Ms. Marie-Léandre Monnerville ECLI:FR:CECHS:2025:492344.20251128
