CJEU, judgment of 9 January 2025, C-394/23, Mousse

1 Overview

The French railway company SNCF required customers buying tickets online to state a title of address ("Monsieur" or "Madame"). The non-governmental organization Mousse challenged that practice before the French data protection supervisory authority. The Conseil d'État referred questions to the Court of Justice concerning the interpretation of the requirement of necessity under Article 6(1)(b) and (f) GDPR.

2 Headnotes

Processing is necessary within the meaning of Article 6(1)(f) GDPR only where the legitimate interest cannot reasonably be achieved by other means that are less intrusive upon the fundamental rights and freedoms of the data subject, in particular upon the rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (paras. 49 et seq.).

In the assessment of necessity it is irrelevant whether the data subject has a right to object under Article 21 GDPR. The existence or non-existence of a right to object is not a criterion capable of mitigating or replacing the necessity of a processing operation (paras. 65 et seq.).

The title of address "Mr" or "Ms" is not objectively indispensable for the issue of a transport ticket. Personalized commercial communication is an interest that as a rule does not fall within the scope of point (b). Where the controller bases the processing on point (f), it must in addition carry out, at stage 3, a balancing of interests into which the transparency obligations also feed.

Where the processing is based on legitimate interests, the interest pursued must be communicated to the data subject at the time of collection (Article 13(1)(d) GDPR); if that information is missing, the processing cannot be based on Article 6(1)(f) GDPR (paras. 46, 52). The communication of the legitimate interest is therefore not a mere formality but a condition of lawfulness; the legal basis cannot be supplied after the event.

3 Significance

The decision sharpens the assessment of necessity under Article 6(1)(f) GDPR. It makes clear that the existence of the right to object does not mitigate the requirements of necessity: a controller cannot rely on the argument that the data subject "can stop the processing anyway". At the same time, the Court of Justice underlines that even apparently harmless data (such as a title of address) may be processed only where they are objectively indispensable for the specific purpose.