C-394/23 - Mousse
- Train company SNCF required customers to indicate their title and gender identity by ticking either Sir or Madam when purchasing a train ticket online
- Such a mandatory requirement cannot be justified under the "contractual performance" or "legitimate interests" legal bases set out in Art. 6 GDPR and infringes on the principles of lawfulness, data minimization and transparency
- CJEU found that processing customersβ titles and gender identities was not necessary for personalizing commercial communications, and therefore could not be justified under the GDPRβs contractual performance legal basis.
- When balancing the pursued legitimate interest with the data subjectsβ rights and freedoms, account should be taken in particular of data subjectsβ reasonable expectations.Β CJEU considered that SNCF customers should not have to expect the SNCF to process their title or gender identity as they purchase train tickets.Β
- There may be a risk of discrimination based on gender identity that should also be taken into account.
- CJEU emphasized that the necessity requirement for relying on either contractual performance or legitimate interests is not met when the objective pursued by the processing could reasonably be achieved as effectively by other, less intrusive means.
- To rely on the legal basis of Art. 6 I b) GDPR, the controller must be able to demonstrate that it would not be able to perform the contract properly without it.
The controller must meet three cumulative conditions in order to rely on legal basis Art. 6 I f) GDPR:
- The controller or a third party must have a legitimate interest in the processing;
- Processing the personal data is necessary to pursue said legitimate interest;
- Data subjects' fundamental rights do not override the legitimate interest
When assessing if a controller may lawfully rely on legitimate interests to process personal data, should the fact that data subjects may have a right to object to the processing be taken into account?
The right to object presupposes that the processing is lawful. The lawfulness of such processing should not depend on the existence of a right to oppose.