Official Journal of the European Union

C series

—

C/2025/1201

(Case C-394/23,

Mousse)

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 5(1)(c) - Data minimisation - Article 6(1) - Lawfulness of processing - Data relating to title and gender identity - Online sale of travel documents - Article 21 - Right to object)

(C/2025/1201)

Language of the case: French

Referring court

Parties to the main proceedings

Applicant: Mousse

Defendants: Commission nationale de l’informatique et des libertés (CNIL), SNCF Connect

Operative part of the judgment

Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation, must be interpreted as meaning that

—

the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract;

—

the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where:

—

those customers were not informed of the legitimate interest pursued when those data were collected; or

—

that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or

—

in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.

Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679 must be interpreted as meaning that, in order to assess the need for processing of personal data under that provision, it is not necessary to take into consideration the possible existence of a right of the data subject to object, under Article 21 of that regulation.

—

(1) OJ C 329, 18.9.2023.

ELI: http://data.europa.eu/eli/C/2025/1201/oj

ISSN 1977-091X (electronic edition)

—