Contents
Judgment of the Court (First Chamber)9 January 2025note(Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Article 5(1)(c) — Data minimisation — Article 6(1) — Lawfulness of processing — Data relating to title and gender identity — Online sale of travel documents — Article 21 — Right to object)In Case C‑394/23,REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 21 June 2023, received at the Court on 28 June 2023, in the proceedingsMoussevCommission nationale de l’informatique et des libertés (CNIL),SNCF Connect,THE COURT (First Chamber),composed of K. Lenaerts, President of the Court, acting as President of the First Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, M.L. Arastey Sahún, A. Kumin and I. Ziemele, Judges,Advocate General: M. Szpunar,Registrar: I. Illéssy, Administrator,having regard to the written procedure and further to the hearing on 29 April 2024,after considering the observations submitted on behalf of:– Mousse, by E. Deshoulières, avocat, Y. El Kaddouri, J. Heymans and D. Holemans, advocaten,– SNCF Connect, by E. Drouard, J.-J. Gatineau and A. Ligot, avocats,– the French Government, by R. Bénard, B. Dourthe and B. Fodda, acting as Agents,– the European Commission, by A. Bouchagiar and H. Kranenborg, acting as Agents,after hearing the Opinion of the Advocate General at the sitting on 11 July 2024,gives the following
Judgment
1This request for a preliminary ruling concerns the interpretation of Article 5(1)(c), points (b) and (f) of the first subparagraph of Article 6(1), and Article 21 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
2The request has been made in proceedings between Mousse, which is an association, and the Commission nationale de l’informatique et des libertés (National Commission for Information Technology and Civil Liberties, France) (‘CNIL’) concerning the latter’s rejection of the complaint lodged by Mousse regarding the processing, by the company SNCF Connect, of data relating to its customers’ titles when travel documents are sold online.
Legal context
European Union law
The GDPR
3Recitals 1, 4, 10, 47 and 75 of the GDPR state:(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.…(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.…(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. ……(47) The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client … of the controller. At any rate[,] the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. … The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.…(75) The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination …’
4Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides, in paragraph 2 thereof:‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’
5Under Article 2(1) of that regulation:‘This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.’
6Article 4 of that regulation, entitled ‘Definitions’, provides:‘For the purposes of this Regulation:(1) “personal data” means any information relating to an identified or identifiable natural person …;(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording …;…(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; ……(11) “consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;…’
7Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides:1.Personal data shall be:(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);…(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);…’
8Article 6 of that regulation, entitled ‘Lawfulness of processing’, provides, in paragraph 1:‘Processing shall be lawful only if and to the extent that at least one of the following applies:(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;(c) processing is necessary for compliance with a legal obligation to which the controller is subject;(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.…’
9Article 13 of that regulation, entitled ‘Information to be provided where personal data are collected from the data subject’, provides:1.Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:…(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;…’
10Article 21 of that regulation, entitled ‘Right to object’, provides, in paragraph 1 thereof:‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’
Directive 2004/113/EC
11According to Article 1 of Council Directive 2004/113/EC of 13 December 2004 implementing the principle of equal treatment between men and women in the access to and supply of goods and services (OJ 2004 L 373, p. 37), the purpose of that directive is to lay down a framework for combating discrimination based on sex in access to and supply of goods and services, with a view to putting into effect in the Member States the principle of equal treatment between men and women.
French law
12Article 8 of the loi No 78-17, du 6 janvier 1978, relative à l’informatique, aux fichiers et aux libertés (JORF du 7 janvier 1978, p. 227) (Law No 78-17 of 6 January 1978 on information technology, data files and freedoms (JORF of 7 January 1978, p. 227), in the version applicable to the dispute in the main proceedings, provides:‘I A. The [CNIL] is an independent administrative authority.I. It is the national supervisory authority for the purposes and the application of the [GDPR]. It shall carry out the following tasks:…2. It shall ensure that the processing of personal data is carried out in accordance with the provisions of this Law and the other provisions relating to the protection of personal data laid down by law and regulation, EU law and the international commitments entered into by [the French Republic].On that basis:…(d) It shall deal with complaints and petitions lodged by a data subject or by a body, organisation or association, examine or investigate the subject matter of the complaint, to the extent necessary, and inform the complainant of the progress made and the outcome of the investigation within a reasonable time, in particular where further investigation or coordination with another supervisory authority is necessary; …’
The dispute in the main proceedings and the questions referred for a preliminary ruling
13SNCF Connect sells rail travel documents such as train tickets, season tickets and discount cards via its website and online applications. The customers of that undertaking are required to indicate their title, by ticking ‘Monsieur’ or ‘Madame’ (‘Mr’ or ‘Ms’) when purchasing those travel documents on that website or on those online applications.
14Taking the view that the conditions for the collection and recording of data relating to the title of those customers did not comply with the requirements of the GDPR, Mousse lodged a complaint with the CNIL against SNCF Connect. In support of that complaint, Mousse claimed that the collection of those data was not consistent with the principle of lawfulness, enshrined in Article 5(1)(a) of the GDPR, since it was not based on any of the grounds set out in Article 6(1) of the GDPR. In addition, in its view, such a collection infringed the principle of data minimisation, referred to in Article 5(1)(c) of the GDPR and, inter alia, the obligations of transparency and provision of information, arising from Article 13 of the GDPR.
15By decision of 23 March 2021, the CNIL found that the facts alleged against SNCF Connect did not constitute infringements of the stated provisions the GDPR and that it was necessary to close the procedure for the examination of that complaint. In support of that decision, the CNIL found that the processing of the data at issue in the main proceedings was lawful, under point (b) of the first subparagraph of Article 6(1) of the GDPR, on the ground that it was necessary for the performance of the relevant contract for the provision of transport services. In addition, the CNIL observed that, in the light of its purposes, that processing was consistent with the principle of data minimisation, since addressing customers in a personalised manner, using their title, corresponded to accepted practices in commercial, civil and administrative communications.
16On 21 May 2021, Mousse brought an action for annulment of that decision of the CNIL before the Conseil d’État (Council of State, France), which is the referring court. In its application, Mousse submits, inter alia, that the obligation to tick the title ‘Monsieur’ or ‘Madame’ when purchasing online does not comply with the principle of lawfulness enshrined in Article 5(1)(a) of the GDPR or with the principle of data minimisation, referred to in Article 5(1)(c) thereof, since that title is not necessary for the performance of a contract for the provision of transport services or for the purposes of SNCF Connect’s legitimate interests. The fact that such titles are used in commercial correspondence does not, in Mousse’s submission, suffice to make such an obligation necessary. Lastly, such an obligation is capable of infringing the right to travel without disclosing one’s title, the right to respect for private life and the freedom freely to define one’s gender expression, and gives rise to a risk of discrimination. As regards nationals of States whose civil status recognises ‘non-binary’, the title ‘Monsieur’ or ‘Madame’ does not reflect reality and may therefore infringe, inter alia, their freedom of movement, guaranteed by EU law.
17The CNIL contends that the action should be dismissed and submits that the processing of the data relating to title can also be classified as necessary for the purposes of the legitimate interests pursued by SNCF Connect, under point (f) of the first subparagraph of Article 6(1) of the GDPR, and that data subjects can, depending on their particular situation, rely on the right to object guaranteed in Article 21 of the GDPR.
18In that context, the referring court asks, inter alia, whether account may be taken, for the purposes of assessing the need for the processing of the data at issue in the main proceedings, of accepted practices in commercial, civil and administrative communications, with the result that the collection of data relating to the title of customers, limited to ‘Monsieur’ or ‘Madame’, may be lawful and consistent with the principle of data minimisation. That court is also uncertain whether, for the purpose of assessing the need for that compulsory collection and subsequent processing of data relating to customers’ titles, even though some customers consider that they do not come under either of the two titles, account should be taken of the fact that those customers may, after having provided those data to the controller in order to receive the relevant service, exercise their right to object to the use of such data on grounds relating to their particular situation, within the meaning of Article 21 of the GDPR.
19In those circumstances, the Conseil d’État (Council of State) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:(1) In order to assess whether data collection is adequate, relevant and limited to what is necessary, within the meaning of Article 5(1)(c) of the GDPR and the need for processing in accordance with points (b) and (f) of [the first subparagraph of Article 6(1) of the GDPR], may account be taken of commonly accepted practices in civil, commercial and administrative communications, with the result that the collection of data relating to customers’ titles, which is limited to “Monsieur” or “Madame”, may be regarded as necessary, without this being precluded by the principle of data minimisation?(2) In order to assess the need for the compulsory collection and processing of data relating to customers’ titles, even though some customers consider that they do not come under either of the two titles and that the collection of such data is not relevant in their case, should account be taken of the fact that those customers may, after having provided those data to the data controller in order to benefit from the service offered, exercise their right to object to the use and storage of those data by relying on their particular situation, in accordance with Article 21 of the GDPR?’
Consideration of the questions referred
The first question
20By its first question, the referring court seeks to ascertain, in essence, whether points (b) and (f) of the first subparagraph of Article 6(1) of the GDPR, read in conjunction with Article 5(1)(c) of that regulation, must be interpreted as meaning that the processing of personal data relating to the title of customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, may be regarded as necessary for the performance of a contract, within the meaning of point (b) of that provision, or as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, within the meaning of point (f) of that provision.
Preliminary observations
21As a preliminary point, it should be noted that the objective pursued by the GDPR, as is set out in Article 1 thereof and in recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU (judgment of 4 October 2024, Schrems (Communication of data to the general public), C‑446/21, EU:C:2024:834, paragraph 45 and the case-law cited).
22In accordance with that objective, any processing of personal data must, inter alia, comply with the principles relating to the processing of such data set out in Article 5 of that regulation and satisfy the lawfulness conditions listed in Article 6 of that regulation (judgment of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C‑621/22, EU:C:2024:857, paragraph 27 and the case-law cited).
23Article 5(1)(a) of the GDPR provides that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
24Under Article 5(1)(c) of that regulation, which enshrines the principle of data minimisation, those data must also be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. That principle gives expression to the principle of proportionality (see, to that effect, judgment of 4 October 2024, Schrems (Communication of data to the general public), C‑446/21, EU:C:2024:834, paragraphs 49 and 50 and the case-law cited).
25As regards the conditions for lawful processing, as the Court has held, the first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, processing must fall within one of the cases provided for in that provision (judgment of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C‑621/22, EU:C:2024:857, paragraph 29 and the case-law cited).
26Under point (a) of the first subparagraph of Article 6(1) of the GDPR, the processing of personal data is lawful if and to the extent that the data subject has given consent for one or more specific purposes. In the absence of such consent, or where that consent is not freely given, specific, informed and unambiguous, within the meaning of Article 4(11) of the GDPR, such processing is nevertheless justified where it meets one of the requirements of necessity mentioned in points (b) to (f) of the first subparagraph of Article 6(1) of that regulation (see, to that effect, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraphs 91 and 92).
27In that context, the justifications provided for in that latter provision, in so far as they allow the processing of personal data carried out in the absence of the data subject’s consent to be made lawful, must be interpreted restrictively (judgment of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C‑621/22, EU:C:2024:857, paragraph 31 and the case-law cited).
28Furthermore, as the Court has held, where it can be found that the processing of personal data is necessary in respect of one of the justifications provided for in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that processing also falls within the scope of another of those justifications. It must be stated, in that regard, that the requirement of necessity relating to the justification relied on is not met where the objective pursued by that processing of data could reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 110 and the case-law cited, and of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 94).
29Lastly, it must be stated that, in accordance with Article 13(1)(c) of the GDPR, where personal data are collected from the data subject, the controller must inform the data subject of the purposes of the processing for which those data are intended as well as the legal basis for the processing (judgment of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C‑621/22, EU:C:2024:857, paragraph 33 and the case-law cited).
30In the present case, it must be noted that it is not disputed that a title, which corresponds to male or female identity, may be classified as ‘personal data’ where it relates to an identified person, within the meaning of Article 4(1) of the GDPR, and that that data is the subject of ‘processing’, within the meaning of Article 4(2) of the GDPR, in so far as it is collected and registered by SNCF Connect in the context of the online sale of travel documents. Consequently, that processing, which is, moreover, automatic in nature, falls within the material scope of that regulation, pursuant to Article 2(1) thereof.
31In addition, the question raised by the referring court is based on two premises, namely, first, that the data processing at issue in the main proceedings is carried out without the consent of the data subjects, within the meaning of Article 4(11) and point (a) of the first subparagraph of Article 6(1) of the GDPR, and, second, that that processing is not necessary for compliance with a legal obligation to which the controller is subject, within the meaning of point (c) of the first subparagraph of Article 6(1) of the GDPR. The question referred therefore relates exclusively to the possibility of relying on the justifications set out in points (b) and (f) of the first subparagraph of Article 6(1) of the GDPR, in the context of the data processing at issue in the main proceedings.
Point (b) of the first subparagraph of Article 6(1) of the GDPR
32Point (b) of the first subparagraph of Article 6(1) of the GDPR provides that the processing of personal data is lawful if it is ‘necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.
33In that regard, in order for the processing of personal data to be regarded as necessary for the performance of a contract within the meaning of that provision, it must be objectively indispensable for a purpose that is integral to the contractual obligation intended for the data subject. The controller must therefore be able to demonstrate how the main subject matter of that contract cannot be achieved if that processing does not occur (judgment of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C‑17/22 and C‑18/22, EU:C:2024:738, paragraph 43 and the case-law cited).
34The fact that such processing may be referred to in the contract or may be merely useful for the performance of that contract is, in itself, irrelevant in that regard. The decisive factor for the purposes of applying the justification set out in point (b) of the first subparagraph of Article 6(1) of the GDPR is that the processing of personal data by the controller must be essential for the proper performance of the contract concluded between the controller and the data subject and, therefore, that there are no workable, less intrusive alternatives (judgment of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C‑17/22 and C‑18/22, EU:C:2024:738, paragraph 44 and the case-law cited).
35In that context, where the contract consists of several separate services or elements of a service that can be performed independently of one another, the applicability of point (b) of the first subparagraph of Article 6(1) of the GDPR should be assessed in the context of each of those services separately (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 100).
36In the present case, it is common ground that the main subject matter of the contract at issue in the main proceedings is the provision of a rail transport service to customers. According to the referring court, the purpose of the data processing at issue in the main proceedings is to personalise commercial communication to the customer, in accordance with commonly accepted practices in that field.
37As the Advocate General observed, in essence, in point 42 of his Opinion, commercial communication may constitute a purpose forming an integral part of the contractual service concerned, since the provision of such a rail transport service involves, in principle, communicating with the customer in order, inter alia, to send him or her a travel document by electronic means, to inform him or her of any changes affecting the corresponding journey, and to allow exchanges with the after-sales service. That communication may require adherence to accepted practices and may include, in particular, forms of addressing a customer, in order to show that the undertaking concerned respects its customer and thereby to safeguard that undertaking’s brand image.
38However, it appears that such communication does not necessarily have to be personalised based on the gender identity of the customer concerned. According to the case-law, personalised content does not appear to be necessary in order to offer services to a customer where those services may, where appropriate, be provided to him or her in the form of an equivalent alternative which does not involve such a personalisation, such that the latter is not objectively indispensable for a purpose that is integral to those services (see, to that effect, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 102).
39As regards the services in question in the main proceedings, a personalisation of the commercial communication, based on presumed gender identity according to a person’s title, does not appear to be either objectively indispensable or essential to enable the proper performance of the contract concerned, within the meaning of the case-law referred to in paragraphs 33 and 34 of the present judgment.
40A workable and less intrusive solution seems to exist, since the undertaking concerned could choose, with regard to customers who do not wish to indicate their title or in general, to communicate based on generic, inclusive expressions when addressing those customers, with no correlation to the latter’s presumed gender identity. Moreover, as the Advocate General observed in points 49 and 50 of his Opinion, it appears, subject to verification by the referring court, that SNCF Connect already uses such expressions and that, in addition, the indication of an incorrect title does not affect the provision of the relevant transport services, which confirms that the data processing at issue in the main proceedings is not objectively indispensable for the performance of the main subject matter of the contract.
41In that context, it should also be noted that, at the hearing, SNCF Connect submitted that the data processing at issue in the main proceedings pursued a second purpose, namely to adapt transport services for night trains, which have carriages reserved for persons with the same gender identity, and to assist passengers with disabilities. According to SNCF Connect, that purpose of adapting transport services may require knowledge of the gender identity of the customers concerned.
42That second purpose cannot justify the systematic and generalised processing of data relating to the title of all customers of the undertaking concerned, including customers who travel during daytime or who do not have disabilities. Such processing would be disproportionate and, on that basis, contrary to the principle of data minimisation, referred to in paragraph 24 of the present judgment, since it could have been limited to the data relating to the gender identity of only those customers who wish to travel in a night train or to receive personalised assistance on account of their disability.
43Thus, point (b) of the first subparagraph of Article 6(1) of the GDPR, read in conjunction with Article 5(1)(c) thereof, must be interpreted as meaning that the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise commercial communication based on those customers’ gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract.
Point (f) of the first subparagraph of Article 6(1) of the GDPR
44Point (f) of the first subparagraph of Article 6(1) of the GDPR provides that the processing of personal data is lawful if it is ‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child’.
45According to settled case-law, that provision lays down three cumulative conditions so that the processing of personal data covered by that provision is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the interests or fundamental freedoms and rights of the person concerned by the data protection do not take precedence over the legitimate interest of the controller or of a third party (judgments of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 106, and of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C‑621/22, EU:C:2024:857, paragraph 37).
46As regards, first, the condition relating to the pursuit of a legitimate interest, it must be stated that, according to Article 13(1)(d) of the GDPR, it is the responsibility of the controller, at the time when personal data relating to a data subject are collected from that person, to inform him or her of the legitimate interests pursued where that processing is based on point (f) of the first subparagraph of Article 6(1) of that regulation. In the absence of a definition of the concept of ‘legitimate interest’ in the GDPR, a wide range of interests is, in principle, capable of being regarded as legitimate. In particular, that concept is not limited to interests enshrined in and determined by law (see, to that effect, judgments of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 107, and of 4 October 2024, Koninklijke Nederlandse Lawn Tennisbond, C‑621/22, EU:C:2024:857, paragraphs 38, 40 and 41 and the case-law cited).
47Thus, it is apparent from recital 47 of the GDPR that such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client of the controller.
48As regards, second, the condition relating to the need for processing personal data for the purpose of attaining the legitimate interest pursued, and having regard to the case-law referred to in paragraph 28 of the present judgment, it is for the referring court to ascertain whether the legitimate interest pursued by the processing of the data can reasonably be achieved just as effectively by other means less restrictive of the fundamental freedoms and rights of data subjects, since such processing must be carried out only in so far as is strictly necessary for the attainment of that legitimate interest.
49In that context, it should also be recalled that the condition relating to the need for processing must be examined in conjunction with the data minimisation principle enshrined in Article 5(1)(c) of the GDPR, in accordance with which personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (judgment of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C‑17/22 and C‑18/22, EU:C:2024:738, paragraph 52 and the case-law cited).
50Lastly, as regards, third, the condition that the interests or fundamental rights and freedoms of the person concerned by the data protection do not take precedence over the legitimate interests of the controller or of a third party, the Court has held that that condition entails a balancing of the opposing rights and interests in question which depends, in principle, on the specific circumstances of the particular case and that, consequently, it was for the referring court concerned to carry out that balancing exercise, taking account of those specific circumstances. Furthermore, as follows from recital 47 of the GDPR, the interests and fundamental rights of the data subject may in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect such processing (see, to that effect, judgment of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C‑17/22 and C‑18/22, EU:C:2024:738, paragraphs 53 and 54 and the case-law cited).
51In the present case, while it is ultimately for the referring court to assess whether, in relation to the processing of personal data at issue in the main proceedings, the three conditions referred to in paragraph 45 of the present judgment are satisfied, it is open to the Court, when giving a preliminary ruling on a reference, to give clarifications to guide the referring court in that determination (see, by analogy, judgment of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C‑17/22 and C‑18/22, EU:C:2024:738, paragraph 55 and the case-law cited).
52As regards the first condition, referred to in paragraph 46 of the present judgment, it will be for the referring court to ascertain whether SNCF Connect informed its customers of a legitimate interest, in accordance with Article 13(1)(d) of the GDPR, at the stage of collecting the data at issue in the main proceedings. As the Advocate General observed in point 58 of his Opinion, that provision requires the controller directly to inform the data subjects of the legitimate interest pursued at the time when the data is collected, otherwise that collection cannot be justified on the basis of point (f) of the first subparagraph of Article 6(1) of that regulation. From the file before the Court, it is not possible to assess whether that requirement was complied with in the case in the main proceedings.
53In that context, it should be noted that, in its written observations, SNCF Connect referred to a direct commercial marketing purpose, which may require personalisation of communication and, consequently, the processing of the data at issue in the main proceedings.
54In that regard, according to the last sentence of recital 47 of the GDPR, the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. In particular, personalised advertising may be equated with direct commercial marketing in such a context (see, by analogy, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 115).
55As regards the second condition, referred to in paragraph 48 of the present judgment, subject to verification by the referring court, it appears that personalised commercial communication can be limited to the processing of customers’ surnames and forenames, since their title and/or their gender identity are information which does not appear to be strictly necessary in that context, in particular in the light of the principle of data minimisation.
56In their respective written observations, SNCF Connect and the French Government submit that, in order to assess the need for the processing of personal data, account must be taken of the common practices and social conventions specific to each Member State, in particular in order to preserve linguistic and cultural diversity, referred to in recital 4 of the GDPR. However, it should be noted, first, that point (f) of the first subparagraph of Article 6(1) of the GDPR does not provide for common practices and social conventions to be taken into account for the purposes of assessing whether such processing is necessary, and that article must be interpreted restrictively, as stated in paragraph 27 of the present judgment.
57Second, a non-processing of data relating to the title or gender identity of the customers concerned does not appear to be capable of affecting that diversity. As follows from paragraph 40 of the present judgment, it is open to the controller to adhere to those accepted practices and social conventions by using, with regard to customers who do not wish to indicate their title or in general, generic, inclusive expressions when addressing those customers, with no correlation to their gender identity, and therefore the line of argument put forward by SNCF Connect and the French Government cannot, in any event, succeed.
58As regards the third condition, referred to in paragraph 50 of the present judgment, and the balancing of the opposing rights and interests involved, namely those of the controller, on the one hand, and those of the data subject, on the other, account must be taken, in particular, of the reasonable expectations of the data subject as well as the scale of the processing concerned and its impact on that person (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 116).
59As the Advocate General observed, in essence, in point 70 of his Opinion, subject to verification by the referring court, a customer of a transport undertaking is not supposed to expect that undertaking to process data relating to his or her title or gender identity in the context of the purchase of a travel document. That would be the case, in particular, if that processing were carried out solely for direct commercial marketing purposes.
60The legitimate interest relating to direct commercial marketing cannot, in any event, prevail where there is a risk that the fundamental freedoms and rights of the data subject will be infringed. As is apparent from recital 75 of the GDPR, the risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular where such processing may give rise to discrimination.
61In that context, in particular, it will be for the referring court to determine whether there is a risk of discrimination on grounds of gender identity, as claimed by Mousse, in particular in the light of Directive 2004/113, which implements the principle of equal treatment for men and women in the access to and supply of goods and services.
62It should be pointed out, in that regard, that the scope of that directive cannot thus be confined simply to discrimination based on the fact that a person is of one or other gender. In view of its purpose and the nature of the rights which it seeks to safeguard, the scope of that directive is also such as to apply to discrimination arising from a change in a person’s gender identity (see, by analogy, judgment of 27 April 2006, Richards, C‑423/04, EU:C:2006:256, paragraph 24 and the case-law cited).
63Consequently, point (f) of the first subparagraph of Article 6(1) of the GDPR, read in conjunction with Article 5(1)(c) of that regulation, must be interpreted as meaning that the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where:– those customers were not informed of the legitimate interest pursued when those data were collected; or– that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or– in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
64In the light of all the foregoing considerations, the answer to the first question is that points (b) and (f) of the first subparagraph of Article 6(1) of the GDPR, read in conjunction with Article 5(1)(c) of that regulation, must be interpreted as meaning that:– the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract;– the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where:– those customers were not informed of the legitimate interest pursued when those data were collected; or– that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or– in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
The second question
65By its second question, the referring court seeks to ascertain, in essence, whether point (f) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that, for the purpose of assessing whether the processing of personal data is necessary under that provision, account should be taken of the possible existence of a right of the data subject to object, on the basis of Article 21 of the GDPR.
66Article 21(1) of the GDPR provides that the data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of the first subparagraph of Article 6(1) of that regulation, including profiling based on those provisions. The controller must no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
67The applicability of Article 21 of the GDPR and, consequently, the possible existence of a right to object presuppose the existence of lawful processing, based in the present case on point (f) of the first subparagraph of Article 6(1) of that regulation. In order to be lawful, such processing must first satisfy the condition of strict necessity, referred to in paragraph 48 of the present judgment.
68As the Advocate General observed in points 80 and 82 of his Opinion, it therefore follows from the wording and scheme of the provisions concerned that the existence of a right to object cannot be taken into consideration for the purpose of assessing lawfulness and, in particular, the need to process personal data at issue in the main proceedings.
69That interpretation is confirmed by the objective pursued by the GDPR, which is, in the light of recital 10 thereof, to ensure a high level of protection of the fundamental freedoms and rights of natural persons with regard to the processing of personal data. Any other interpretation would have the effect of weakening the requirements referred to in point (f) of the first subparagraph of Article 6(1) of the GDPR, by extending the grounds for the lawfulness of the processing concerned, even though that provision must be interpreted restrictively, in the light of the case-law referred to in paragraph 27 of the present judgment.
70In the light of all of the foregoing considerations, the answer to the second question is that point (f) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that, in order to assess the need for processing of personal data under that provision, it is not necessary to take into consideration the possible existence of a right of the data subject to object, under Article 21 of the GDPR.
Costs
71Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
Operative part
On those grounds, the Court (First Chamber) hereby rules:
1.Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation,must be interpreted as meaning that– the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract;– the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where:– those customers were not informed of the legitimate interest pursued when those data were collected; or– that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or– in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
2.Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679must be interpreted as meaning that, in order to assess the need for processing of personal data under that provision, it is not necessary to take into consideration the possible existence of a right of the data subject to object, under Article 21 of that regulation.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.