Conseil d'Etat – Court Ruling (France, 2025)

The law of 2 March 2022 had introduced Article 61-3-1 of the Civil Code, which created a simplified procedure to change one’s surname in France. This reform led to an increase in name changes, which were only registered in civil status registers and not in administrative databases. In response, the French Ministry of the Interior adopted, on 19 December 2023, an Order creating an automated table called “table of correspondence of first and family name”. This table relied on eight categories of information: first name and family name before and after the change, the place and date of birth, the date of the change of name, the gender and, where applicable, the parental link (filiation). On 4 March 2024, the Ligue des droits de l'Homme (LDH) brought a case to the supreme administrative Court against the Minister of the Interior regarding its Order of 19 December 2023, with additional claims filed on 4 June 2024. Issues under the GDPR Firstly, the LDH contended that the processing revealed special categories of personal data within the meaning of Article 9 GDPR. Secondly, it submitted that Article 6(1)(e) GDPR was breached because no sufficiently defined public interest task justified the processing. Thirdly, LDH relied on Article 5(1)(c) GDPR, claiming that the scope of data collected, particularly sex and parental link (filiation), was not limited to what was necessary for the purposes put forward by the State. Fourthly, invoking Article 5(1)(f) GDPR, it maintained that there was a risk of uncontrolled dissemination of the data in view of the potentially large number of services and agents authorised to access the table. Fifthly, under Article 5(1)(e) GDPR, it argued that the principle of storage limitation was not respected, on the basis that the six-year retention period for the personal data was excessive while the three-year retention period for logging data was insufficient. Sixthly, LDH claimed a breach of Article 12 GDPR, asserting that data subjects were not