Mandatory collection of individual titles (“Mr.”/ “Mrs.”): the French Administrative Supreme Court endorses the CJEU’s teachings and overrules the CNIL

Conseil d’État, July 31, 2025, n° 452850, Association MOUSSE

On July 31, 2025, the French Administrative Supreme Court (“Conseil d’État”) handed down an awaited decision in the case opposing the association MOUSSE and the French Data Protection Authority (the CNIL), concerning the mandatory collection of individual titles (“Mr.” / “Mrs.”) by the French train company SNCF. This dispute, which gave rise to a referral to the Court of Justice of the European Union (CJEU) which we also commented on (see here in French), is likely to have practical consequences that go far beyond the SNCF case alone.

Background and previous decisions

At the origin of the case: a complaint lodged with the CNIL at the end of 2020 by the MOUSSE association against SNCF, on the grounds that the requirement for customers to indicate their civility – via a choice between “Mr.” or “Mrs.” – when ordering online was contrary to several principles of the GDPR. In particular, the association cited the absence of a valid legal basis for this processing, its unnecessary nature – in contradiction with the principle of minimization, its lack of transparency and the potential inaccuracy of the data thus collected, as the binary choice between “Mr.” or “Mrs.” would fail to reflect the diversity of gender identities. TheCNIL rejected this complaint in a decision issued in March 2021, finding in particular that the collection of individual titles was in line with accepted practice, enabling SNCF to personalize communications with its customers, and could be based on the performance of the transport contract.

As part of the appeal lodged by the MOUSSE association against the CNIL decision, the Conseil d’Etat decided to stay the proceedings and to refer two questions to the CJEU: the possibility of basing the compulsory collection of civility data on contractual performance or legitimate interest, and the possibility of taking into account the existence of a right to object when assessing the necessary nature of personal data processing on this second basis.

In its ruling C-394/23 of January 9, 2025, the CJEU rejected the possibility of basing the collection of civility on the performance of the contract and, with regard to legitimate interest, demanded a rigorous demonstration in particular of the necessary nature of the processing. The Court also ruled that the existence of a right to object did not have to be taken into account when analyzing the legal basis of the legitimate interest.

Conseil d’État draws conclusions from European ruling

On July 31, 2025, the Conseil d’État annuled the decision to close the complaint lodged by the MOUSSE association, issued by the President of the CNIL on March 23, 2021.

It held that the French authority had erred in law in considering that the contested processing – namely, the mandatory collection of the civility “Mr.” / “Mrs.” – could be based on the performance of a contract (Article 6.1.b of the GDPR), contrary to the strict interpretation given by the Court of Justice of the European Union in its ruling of January 9, 2025.

Indeed, the Conseil d’Etat recalls by reference to the CJEU’s decision that, for processing to be justified by Article 6.1.b of the GDPR, it must be “objectively indispensable” to the performance of a contractual obligation. However, individual titles does not constitute data that is indispensable to the performance of the rail transport service. The objective of personalizing commercial communication or the desire to align with usual practices is not sufficient to characterize this necessity.

With regard to the alternative basis based on legitimate interest (Article 6.1.f of the GDPR), the Conseil d’État also ruled out the possibility of SNCF mobilizing this legal basis to justify the mandatory collection of titles. The Conseil d’État considered that, even if the collection of titles enables the company to address customers according to widespread social customs, this objective could be achieved without making this information mandatory. It also considered that neither the need to identify passengers, nor the specific features of certain services offered by SNCF – notably the adaptation of transport services for night trains with carriages reserved for men or women – were sufficient to justify generalized mandatory collection. Consequently, the processing in question could not be considered strictly necessary for the pursuit of a legitimate interest within the meaning of the GDPR.

Lastly, the Conseil d’Etat confirmed that the subsequent exercise of the right to object had no impact on the assessment of the necessity of the processing under Article 6.1.f of the GDPR concerning the legal basis of legitimate interest.

Implications that go beyond the SNCF case alone

The Conseil d’Etat’s decision has very broad implications, insofar as the mandatory collection of individual titles remains a widespread practice in many online services. It should be noted, however, that the decision does not prohibit such collection per se: it can remain lawful if it is strictly justified and targeted, and not systematically imposed on all users.

Neither the CJEU nor the Conseil d’Etat explicitly ruled on the argument raised by the MOUSSE association regarding the inaccuracy of the processing linked to the limitation of choices to “Mr.” and “Mrs.”, which does not, according to this association, reflect all gender identities. This sensitive issue could give rise to further litigation by civil rights associations. It is also possible that the CNIL will clarify its position on this point when it re-examines the complaint lodged by the MOUSSE association, as required by the Conseil d’Etat.

Although this decision is likely to have an impact on many data controllers, it is not certain that the CNIL will make it a priority area of control, particularly in view of the authority’s initial position on this issue.