Lawfulness - Contractual necessity
2 preliminary rulings of 9 Jan 2025, C-394/23 (Mousse) 
Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation must be interpreted as meaning that
– the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract;
– the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where:
– those customers were not informed of the legitimate interest pursued when those data were collected; or
– that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or
– in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
of 12 Sep 2024, C-17/22 (HTB Neunte Immobilien Portfolio)
Point (b) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),must be interpreted as meaning that the processing of personal data which consists in disclosing, at the request of a partner of an investment fund established in the form of a partnership offering shares for public subscription, information on all the partners with indirect shareholdings in that fund, through trust companies, irrespective of the size of their shareholding in the capital of those funds, for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a consensus in connection with partners’ resolutions, may be regarded as being necessary, within the meaning of that provision, for the performance of the contract pursuant to which those partners have purchased such shareholdings, only on condition that that processing is objectively indispensable for a purpose that is integral to the contractual obligation intended for those same partners, with the result that the main subject matter of the contract could not be achieved if that processing were not to occur. That is not the case if that contract expressly prohibits the disclosure of those personal data to other shareholders.
Disclaimer