Mind the GDPR gap: The CJEU’s strict approach to data minimization and lawfulness in Mousse v SCNF
Posted: February 4, 2025
A train company cannot force its customers to declare their title when buying train tickets, according to a recent Court of Justice of the European Union (CJEU) judgment providing a strict interpretation of several important GDPR provisions.
Here’s a look at Mousse v SCNF Connect and what it means for online retailers and other businesses.
What’s the background?
A civil society group, Mousse, submitted a complaint to the French Data Protection Authority (DPA), the CNIL, about SCNF Connect, a company that sells rail tickets and other travel documents.
When purchasing a rail ticket from SCNF, travelers were required to provide their title—Monsieur or Madame (Mr or Ms). SCNF made “title” a mandatory field, meaning customers had no choice but to reveal their gender to buy a rail ticket.
Why was the ‘title’ field mandatory?
SCNF said customers were required to declare their titles to receive personalized communications. Knowing a person’s title enabled SCNF to begin an email with, for example, “Bonjour Madame” rather than simply “Bonjour”.
SCNF said it had a legal basis for collecting this data, arguing that it was necessary for the performance of a contract with the passenger.
Mousse argued that this practice violated the GDPR’s principle of “lawfulness, fairness, and transparency”, which (among other things) requires all processing of personal data to have a “lawful basis”.
Mousse claimed that collecting each customer’s title was not necessary to enable SCNF to fulfil its contractual obligations—the company could sell its customers rail tickets without knowing their genders.
Mousse also argued that SNCF’s practice violated the principle of “data minimization”, which requires companies to collect only the minimum amount of personal data necessary to fulfil a specified purpose—in this case, selling someone a rail ticket.
Furthermore, Mousse argued that SNCF’s practice was discriminatory. Some passengers don’t use either “Monsieur” or “Madame” but are forced to choose one of these titles when purchasing a rail ticket.
What did the CNIL say?
The CNIL sided with SCNF, finding that the company’s reliance on the legal basis of “contract” was valid.
Because the CNIL believed collecting a passenger’s title was necessary for SNCF to fulfil its contractual obligations, it found that SCNF had not violated the lawfulness, fairness, and transparency or data minimization principles.
The CNIL also found that even if SCNF could not rely on the lawful basis of “contract”, it might have grounds to rely on another lawful basis, “legitimate interests”. The CNIL said “legitimate interests” might be a suitable lawful basis for the collection of passengers’ titles because:
- The use of titles was deemed consistent with accepted commercial and administrative practices. The CNIL considered personalizing customer communications through the use of titles aligned with SNCF’s legitimate interests in maintaining respectful and professional interactions with its customers.
- If SCNF were to rely on “legitimate interests”, data subjects could exercise their right to object under Article 21 of the GDPR if they believed that the use of their title infringed their rights or freedoms.
Mousse appealed the CNIL’s decision, and the case reached France’s top court, the Council of State, which referred several questions to the CJEU.
What did the Council of State ask the CJEU?
The Council of State asked the CJEU to answer the following questions:
- Are “commonly accepted practices in civil, commercial and administrative communications” (such as asking people whether they use “Monsieur” or “Madame”) relevant when assessing compliance with:
- The data minimization principle,
- The lawful basis of “contract”, and
- The lawful basis of “legitimate interests”?
- SNCF’s mandatory collection of titles means that a person could be forced to declare that they are a “Monsieur” or a “Madame”, even if they don’t identify as either. Is this problem mitigated by the fact that they can later exercise their “right to object” under the GDPR to stop the company from referring to them as such?
How did the CJEU respond?
Data minimization
The CJEU found that commonly accepted practices cannot justify processing personal data that is not strictly necessary for a given purpose.
Even if using titles like “Monsieur” or “Madame” is customary in communication, the principle of data minimization requires data to be adequate, relevant, and limited to what is necessary for the stated purposes.
The CJEU held that SNCF could communicate effectively using less intrusive alternatives, such as generic and inclusive expressions like “Dear Valued Customer” rather than “Dear Mr Mousse.”
As such, the data minimization principle applies despite the commonly accepted practices in question.
Contract
The CJEU ruled that the processing of titles was not “objectively indispensable” for the performance of the contract in question.
The personalization of communications does not form an integral part of selling a train ticket, and so collecting titles cannot be justified on this lawful basis.
Legitimate interests
The CJEU did not rule out that SCNF might have a legitimate interest in collecting this personal data for the purposes of personalizing communications or aligning with societal norms.
However, the court emphasized that these interests must be balanced against the rights and freedoms of data subjects.
In this case, the CJEU was highly skeptical that the processing of titles was strictly necessary for SNCF’s legitimate interests because:
- Alternatives exist, such as using generic expressions,
- The practice risked causing discrimination based on gender identity, and
- Customers were not informed about the legitimate interests at the time of data collection
The right to object
The CJEU ruled that the right to object under Article 21 of the GDPR would not mitigate the issues raised by the mandatory collection of titles, emphasizing that:
- The lawfulness of a processing activity must be assessed independently of whether a data subject can later object,
- Allowing the right to object to justify otherwise unnecessary data collection would weaken the GDPR’s protections, and
- The mandatory collection of titles, particularly when some individuals do not identify with the provided options, poses risks of discrimination and does not comply with the data minimization principle.
A ‘strictly necessary’ approach to data minimization and lawfulness
Much of the CJEU’s judgment in Mousse follows from the GDPR’s basic principles and provides a reasonable, common-sense interpretation of the concepts of data minimization and lawfulness.
However, the court provides a strict interpretation of these provisions, repeatedly using the term “strictly necessary” where the law uses a mere “necessary”.
This suggests that businesses have very little discretion in how they apply these to their data collection practices—don’t process personal data unless it’s “strictly necessary” for your purposes.