Today, following a referral from an organisation and after consulting the Court of Justice of the European Union (CJEU), the Conseil d’État ruled that SNCF Connect cannot require its customers to provide their title. This data processing does not comply with the General Data Protection Regulation (GDPR), which stipulates that only strictly necessary personal data must be collected. The collection of titles is not essential for the sale of tickets or identity checks during train journeys. In addition, the provision of specific services based on gender is not grounds for systematically requiring a passenger’s title.
The forms for purchasing train tickets, season tickets or loyalty cards on the SNCF Connect website and app require users to indicate their title. Considering that this obligation and the resulting processing of personal data were contrary to the GDPR, an organisation brought a claim before the French data protection authority (CNIL).
After the CNIL rejected the organisation’s complaint, the latter referred the matter to the Conseil d’État, requesting the annulment of this decision. Before issuing a ruling, the Conseil d’État consulted the CJEU, seeking guidance on the interpretation of articles 5, 6 and 21 of the GDPR.
In its decision of 9 January 2025, the CJEU pointed out that the GDPR provides an exhaustive and restrictive list of cases in which the processing of personal data can be considered lawful. This is true when data processing is necessary for the performance of a contract or for the purposes of the legitimate interests pursued by the data controller. Regarding the first possible justification, the Court ruled that if the sole purpose of collecting the titles of customers of a transport company is to personalise commercial communications, this cannot be considered necessary for the performance of the contract between users and the company. In this respect, it noted that although certain services, such as sleeping compartments reserved for women travelling alone, require the collection of data relating to gender, this does not justify making the collection of titles mandatory for all the services offered by SNCF Connect. Regarding the second justification, while leaving it to the national court to verify this, the CJEU considered that collecting customers’ titles did not appear strictly necessary for the personalisation of commercial communications. Lastly, the CJEU ruled that to assess the need to process personal data, it was not necessary to take into account the possibility provided for in the GDPR to object a posteriori to the processing of titles provided at the time of purchase.
As a result of the CJEU’s ruling, the Conseil d’Etat recognised that the systematic processing of personal data relating to customers’ titles for the sole purpose of personalising the commercial relationship could not be considered necessary for the performance of a passenger transport contract by a rail company. It also noted that it did not appear from the documents in the file that the absence of titles on tickets would make it more difficult to identify passengers, as required by the French Transport Code.
Furthermore, the Conseil d’Etat ruled that while the processing of titles allows the company to address people in the manner to which they are accustomed, possible in accordance with the expectations of a significant proportion of its customers, the same result can be achieved by giving customers the option of indicating their title. The Conseil d’Etat, therefore, considered that the requirement for customers to provide their title went beyond what is strictly necessary for the purposes of SNCF Connect’s legitimate interests.
On these grounds, the Conseil d’Etat ruled that the CNIL could not legally assert that the disputed processing of personal data was necessary for the performance of the contract between SNCF Connect and its customer, or that it was based on the legitimate interests of the data controller or consideration of the right to object.
The CNIL’s decision of 23 March 2021 was annulled and the organisation’s complaint must be reviewed.
Read the decision (in French)