GDPR
On January 9, 2025, the Court of Justice of the European Union ("CJEU") delivered its judgment in Case C-394/23, Mousse v. SNCF Connect. This marks a significant interpretation of the GDPR by underscoring the principle of data minimisation in the light of limiting the collection of personal data within commercial contexts to that which is strictly needed.
Background
The French railway operator, SNCF Connect ("SNCF"), required each of their customers to indicate their title (i.e. Mr or Ms) upon purchasing transport tickets online. The French Association Mousse argued that such a requirement contravened the GDPR. Specifically, the Association claimed that the data collection manifestly violated the principle of data minimisation, enshrined by article 5(1)(c) of the GDPR, as such information is not necessary for completing this specific transaction and is data which unnecessarily corresponds to gender identity.
Findings
The CJEU reaffirmed the GDPR's principle with regards to data minimisation, mandating that personal data must be: "Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed."1 The Court considered two key elements on lawful data processing, namely:
- Contractual Necessity, whereas the processing of data must be "objectively indispensable", effectively finding that such processing was not necessary in the context of executing a purchase for a transport ticket; and
- Legitimate interest, whereas the data processing must align
with a legitimate interest pursued by the data controller.
Naturally, without overriding the fundamental rights and freedoms
of data subjects.2On this front, the CJEU outlined
several points of note, namely:
- SNCF's customers were not adequately informed of the legitimate interest being pursued;
- Such processing was not strictly necessary for the stated purposes (that of purchasing transport tickets online); and
- The fundamental freedoms and rights, including the risk of discrimination based on gender identity outweighed the commercial interest in personalised communication.
The latter point was emphasised by the Court, stating that the potential unnecessary discrimination risks render the processing as disproportionate, further invalidating the SNCF's practices.
Future implications
Undoubtedly, this judgment has far-reaching implications for companies operating within the EU especially in transport sectors such as shipping and aviation and it reaffirms the need for all organisations to critically assess whether the personal data they are currently collecting is essential for their business processes.
Footnotes
1. Article 5(1)(c), GDPR
2. Article 6(1)(f), GDPR
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
