---
title: "Case C-394/23: judgment of 9 January 2025"
canonical: "https://dposchool.com/gdpr/case/c-394-23"
source: "https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en"
source_note: "Only the judgment as published by the Court of Justice is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Court of Justice judgment · Case C-394/23

# Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Case:** C-394/23
- **Court:** Court of Justice
- **Date of judgment:** 9 January 2025
- **ECLI:** ECLI:EU:C:2025:2
- **Instrument:** Regulation (EU) 2016/679 (GDPR)
- **Provisions:** [Article 5(1)(c)](https://dposchool.com/gdpr/article/5#1-c), [Article 6(1)(b)](https://dposchool.com/gdpr/article/6#1-b), [Article 6(1)(f)](https://dposchool.com/gdpr/article/6#1-f), [Article 21](https://dposchool.com/gdpr/article/21)

## Holding (summary, not the official text)

Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test.

## Official source

- [Case C-394/23 on CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en)
- [Judgment on EUR-Lex (CELEX 62023CJ0394)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394)

Checked against the official source on 28 October 2026.

Only the judgment as published by the Court of Justice is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Judgments](https://dposchool.com/gdpr/cases) / C-394/23

[All judgments](https://dposchool.com/gdpr/cases)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents