Excessive processing of personal data: the collection of titles must not be systematic

On 31 July 2025, following a referral from the Mousse association, the French Council of State ruled on the lawfulness of collecting the titles of data subjects. The Council concluded that the processing of such personal data for the sole purpose of commercial personalization was not necessary.

The Council of State judges focused the debate on the principle of data minimization and took followed of the position of the Court of Justice of the European Union (CJEU). They clarified the scope of which data is strictly necessary for the performance of a contract between a customer and a company.

‍

This decision directly challenges the practices of economic actors, who must now reassess the relevance of certain data collected in their customer journeys. We take stock in this article.

‍

SNCF Connect versus the Mousse association

‍

In 2021, the Mousse association filed a complaint with the French Data Protection Authority (CNIL) against SNCF Connect's practice of systematically collecting passengers’ title ("Madame" or "Monsieur") when purchasing tickets online. The Mousse association argued that that such data processing related to gender identity and was not necessary for the purpose pursued. However, the CNIL rejected the complaint.  

‍

Following the association’s request to overturn the CNIL's decision, the Council of State decided to suspend the proceedings and refer two questions to the CJEU for a preliminary ruling on whether:  

• practices in civil, commercial, and administrative communications should be taken into account to justify the collection of data on titles, and to rule out any infringement of the principle of data minimization, and  

• the possible existence of a right of objection for the data subject, based on their particular situation, should be taken into consideration to assess the necessity of a data processing.  

‍

Response to preliminary questions and European position - CJEU, Mousse v. Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect, January 9, 2025, C-394/23

‍

On the first question, the CJEU considered that the processing cannot be regarded as necessary, and that the practices in civil, commercial, and administrative communications cannot override the principle of data minimization.

‍

On the second question, the CJEU concluded that there is no need to take into account the possible existence of a right to object when assessing the necessity of a data processing, as such right can only exist in the presence of lawful processing.  

‍

The importance of the principle of minimization - Council of State, Association Mousse, Litigation Section, 10th and 9th Chambers combined, July 31, 2025, No. 452850

‍

The Council of State has drawn conclusions from the European decision, judging that systematically processing personal data relating to customers' titles for the sole purpose of personalizing the commercial relationship cannot be considered as necessary for the performance of a railway company’s passenger transport contract.  

‍

The Council of State points out that, in order to be lawful, the processing of data relating to titles must comply with the following principles:

• be based on one of the legal basis provided for in Article 6 of the GDPR,

• comply with the principles of data minimization and accuracy, and  

• comply with the transparency and information requirements of Articles 5 and 13 of the GDPR.  

‍

By systematically collecting passengers' titles even when it is not necessary for the transport contract (e.g., for allocating seats in a unisex sleeper compartment), and by limiting this collection to the options "Madame" or "Monsieur" with no neutral option available, SNCF Connect is in breach of these GDPR’s principles.

‍

While the processing allows SNCF Connect to engage with its customers in line with the standards and expectations of a significant part of its clientele, the Council of State found that this result could be achieved by making the mention of the title optional. This would have satisfied the GDPR’s requirements and not gone beyond what is strictly necessary to achieve the legitimate interest pursued by SNCF Connect.  

‍

Best practices

‍

In order to prevent any risk of non-compliance with the GDPR and ensure the appropriate and proportionate use of their customers' personal data, all economic actors must pay renewed attention to the systematic collection of data relating to titles.

‍

What are the best practices and habits to adopt?

• Assess the appropriateness and necessity of collecting title information in relation to the goods and services provided,

• Limit collection to situations where it is strictly necessary, or make it optional,

• Include a neutral option on collection forms, such as "Neutral" / "Other" / "Do not wish to answer",  

• Use neutral, inclusive language in customer communications that does not correlate with customers' presumed gender identity,

• Where applicable, clearly inform customers of the purpose of collecting their title and update your privacy policy to ensure complete and transparent information.

‍

If you have any questions or need assistance, please do not hesitate to contact our IT/Data team!  

‍

‍

Jeannie Mongouachon, Partner and Juliette Lobstein, Associate, at Squair