Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect (C-394/23)

Judgment of 9 Jan 2025

law://eu/cjeu/2023/c-394-23/para_28@2026-11-14

28Furthermore, as the Court has held, where it can be found that the processing of personal data is necessary in respect of one of the justifications provided for in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that processing also falls within the scope of another of those justifications. It must be stated, in that regard, that the requirement of necessity relating to the justification relied on is not met where the objective pursued by that processing of data could reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 110 and the case-law cited, and of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 94).

Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect (C-394/23)

History · 1 version

Key facts

Connections