Cass. - CCASS:2025:SO00378

Cass. - CCASS:2025:SO00378
Court:	Cour de Cassation (France)
Jurisdiction:	France
Relevant Law:	Article 4(1) GDPR Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1)(a) GDPR 624 CPC
Decided:	09.04.2025
Published:
Parties:	M. [E] IGC
National Case Number/Name:	CCASS:2025:SO00378
European Case Law Identifier:	ECLI:FR:CCASS:2025:SO00378
Appeal from:	Cour d'Agen (France)
Appeal to:	Cour de Cass.
Original Language(s):	French
Original Source:	Cour de Cassation (in French)
Initial Contributor:	Orla Harris

The Court of Cassation found that an employer unlawfully processed an employee's IP address in its IT log files in order to investigate an employee’s misconduct, leading to the employee's dismissal.

English Summary

Facts

The controller, IGC, a French construction company, hired the data subject, M. [E], as a branch manager on 8 July 2004. The controller dismissed the data subject for gross misconduct on 16 December 2019. The controller relied upon an IP address captured in IT log files as evidence of serious misconduct. The data subject contested the dismissal. The Agen Court of Appeal accepted the controller’s evidence and upheld the data subject’s dismissal on 10 January 2023. The data subject appealed the Agen Court’s judgment to the Court of Cassation (highest appeal court for civil and criminal cases in France).

Holding

The Court analysed whether an IP address captured in IT log files is personal data within the meaning of Article 4(1) GDPR and whether a controller's use of those logs to identify an employee for disciplinary control is lawful under Articles 5 and 6 GDPR.

On 9 April 2025, the Court of Cassation firstly reaffirmed that IP addresses are personal data as they allow the indirect identification of a natural person within the meaning of Article 4(1) GDPR. Secondly, the Court of Cassation noted that processing must be lawful, fair and transparent as per Article 5(1)(a) and purpose bound as per Article 5(1)(b) GDPR.

In this case, the Court found that the controller processed the IP address in the IT logs for the purpose of individual discipline measures and that the data subject did not consent to the controller using the IP address in the IT logs for that purpose. The Court of Cassation deemed the processing not to be in compliance with Article 5(1)(a) GDPR and Article 5(1)(b) GDPR.

Therefore, the Court quashed and annulled the Agen decision in full. The Court referred the case back to the Pau Court of Appeal. Finally, the Court of Cassation ordered the controller to pay €2,000 to the data subject.

Comment

Unfortunately, the decision from the Court of Cassation was incomplete as it did not include the Agent Court of Appeal’s decision nor a link to it. Pau and Agen are places in France, cities specifically. Without prior knowledge, one may think that Pau or Agen are special courts, but in fact, they are appeal courts in different cities of France.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

FRENCH REPUBLIC
IN THE NAME OF THE FRENCH PEOPLE

THE COURT OF CASSATION, SOCIAL CHAMBER, has rendered the following judgment:

SOC.

JL10

COURT OF CASSATION
______________________

Judgment of April 9, 2025

Cassation

Ms. MARIETTE, Senior Judge
acting as President

Judgment No. 378 F-D

Appeal No. D 23-13.159

FRENCH REPUBLIC

_________________________

IN THE NAME OF THE FRENCH PEOPLE
_________________________

JUDGMENT OF THE COURT OF CASSATION, SOCIAL CHAMBER, OF APRIL 9, 2025

Mr. [Z] [E], residing at [Address 1], filed appeal No. D 23-13.159 against the judgment rendered on January 10, 2023, by the Court of Appeal of Agen (Social Chamber), in the dispute opposing him to IGC, a public limited company Simplified single-member company, whose registered office is at [Address 2], respondent in cassation.

The appellant relies on three grounds of cassation in support of its appeal.

The case file was forwarded to the Attorney General.

Upon the report of Mr. Carillon, reporting judge, and after hearing the submissions of SARL Thouvenin, Coudray and Grévy, counsel for Mr. [E], and of SCP Rocheteau, Uzan-Sarano and Goulet, counsel for IGC, and after deliberations in the public hearing of March 11, 2025, where Ms. Mariette, senior judge acting as president, Mr. Carillon, reporting judge, Mr. Barincou, judge, and Ms. Pontonnier, clerk of the court were present,

the Social Chamber of the Court of Cassation, composed of the aforementioned president and judges, having deliberated in accordance with the law, rendered the following judgment.

Facts and Procedure

1. According to the judgment under appeal (Agen, January 10, 2023), Mr. [E] was hired as branch manager on July 8, 2004, by IGC Cahors (the company).

2. The employee, dismissed on December 16, 2019, for serious misconduct, brought an action before the labor court to contest his dismissal.

Review of the grounds

On the ground raised by the court of its own motion

3. After notice given to the parties in accordance with Article 1015 of the Code of Civil Procedure, Article 620, paragraph 2, of the same Code is applied.

Having regard to Articles 4, 5 and 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR):

4. According to Article 5 of the GDPR, personal data must be processed lawfully, fairly and transparently in relation to the data subject (lawfulness, fairness, transparency) and collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

5. According to Article 6(1), processing is lawful only if and to the extent that at least one of the following conditions is met, in particular:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes.

6. It follows that IP addresses, which allow for the indirect identification of a natural person, are personal data within the meaning of Article 4 of the GDPR, and therefore their collection through the use of the log file constitutes the processing of personal data, which is lawful only if the data subject has given their consent.

7. In order to uphold the dismissal and dismiss the employee's claims in this regard, the judgment, after noting that the employer produced a bailiff's report detailing information from the log files and their cross-referencing with messages sent from the IP address assigned to the employee, concludes that IP address 172.25.11.3 is not assigned by an Internet service provider. He adds that it is a Class B IP address, which corresponds to a local network address and does not need to be declared to the CNIL (French Data Protection Authority) because it only identifies devices on the local network and not a natural person; that it contains no personal data and only identifies a computer.

8. He concludes that since no declaration to the CNIL is required, the bailiff's intervention is lawful and his report constitutes admissible evidence.

9. In so ruling, when the use of the log files, which had indirectly identified the employee, constituted the processing of personal data within the meaning of Article 4 of the GDPR, and when it found that the employer had processed this data, without the employee's consent, for a purpose other than that for which it had been collected—namely, the individual monitoring of his activity—and when the evidence was therefore unlawful, the Court of Appeal violated the aforementioned provisions.

Scope and Consequences of the Cassation

10. Pursuant to Article 624 of the Code of Civil Procedure, the quashing of the part of the judgment finding the dismissal justified and dismissing the employee's claims in this respect entails the quashing of the part of the judgment dismissing his claim for damages for wrongful dismissal, which is necessarily dependent upon it.

FOR THESE REASONS, and without ruling on the grounds of appeal, the Court:

QUASHES AND SETS ASIDE, in its entirety, the judgment rendered on January 10, 2023, between the parties, by the Court of Appeal of Agen;

Reinstates the case and the parties to the position they were in before that judgment and remands them to the Court of Appeal of Pau;

Orders IGC to pay the costs;

Pursuant to Article 700 of the Code of Civil Procedure, dismisses the application filed by IGC and orders it to pay Mr. [E] the sum of €2,000;

Directs that, upon the application of the Attorney General at the Court of Cassation, this judgment shall be transmitted for transcription in the margin or following the quashed judgment;

Thus done and adjudged by the Court of Cassation, Social Chamber, and pronounced publicly on April 9, 2025, by making the judgment available at the registry of the Court, the parties having been previously notified under the conditions provided for in the second paragraph of Article 450 of the Code of Civil Procedure. ECLI:FR:CCASS:2025:SO00378