CJEU Case C-394/23 / Judgment
-
CJEU Case C-394/23 / Judgment
Key facts of the case:
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object
Ouctome of the case:
On those grounds, the Court (First Chamber) hereby rules:
- Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation must be interpreted as meaning that
- the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract;
- the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where:
- those customers were not informed of the legitimate interest pursued when those data were collected; or
- that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or
- in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
- Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679 must be interpreted as meaning that, in order to assess the need for processing of personal data under that provision, it is not necessary to take into consideration the possible existence of a right of the data subject to object, under Article 21 of that regulation.
- Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation must be interpreted as meaning that
-
Paragraphs referring to EU Charter
21. As a preliminary point, it should be noted that the objective pursued by the GDPR, as is set out in Article 1 thereof and in recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU (judgment of 4 October 2024, Schrems (Communication of data to the general public), C‑446/21, EU:C:2024:834, paragraph 45 and the case-law cited).
...
28. Furthermore, as the Court has held, where it can be found that the processing of personal data is necessary in respect of one of the justifications provided for in points (b) to (f) of the first subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that processing also falls within the scope of another of those justifications. It must be stated, in that regard, that the requirement of necessity relating to the justification relied on is not met where the objective pursued by that processing of data could reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 110 and the case-law cited, and of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537, paragraph 94).
-
Paragraphs referring to EU Charter (original language)