Legitimate interest vs consent: French Supreme Court, 17 June 2026

Verifiable fact. On 17 June 2026, the Commercial Chamber of the French Supreme Court held that relying on legitimate interest (Art. 6(1)(f) GDPR) requires strict Article 14 information where data were not obtained from the data subject — including in litigation. Takeaway: the “litigation exception” does not waive information duties. See the decision: Cour de cassation, 17 June 2026, No. 25‑11.499.

The case

The Court quashed an appeal judgment that had validated, in the name of the “right to evidence” in an internal election dispute, the production of an external audit report (EY) manipulating email metadata and electoral lists. The lower courts admitted legitimate interest without establishing that employees — whose data came from indirect sources — had been informed of the interests pursued (Art. 14 GDPR). Absent this, the decision lacked a legal basis. Reference: 17 June 2026 ruling.

In parallel, on 3 June 2026 (1st civ., No. 25‑14.228), the Court reiterated accuracy (Art. 5(1)(d)) and erasure/objection rights (Arts. 17, 21) regarding online content: 3 June 2026 ruling.

Legal reasoning

• Legal basis (Art. 6(1)(f)). Three cumulative conditions: legitimate interest, necessity, and a documented balancing test. See CNPD guidance: lawfulness of processing.
• Information for indirect collection (Art. 14). Controllers must inform data subjects of purposes, legal basis and “the legitimate interests pursued” (Art. 14(1)(d)) where data were not obtained directly. This is precisely what the Court found missing on 17 June 2026.
• EU consistency. The CJEU has tightened necessity/minimisation and the duty to explain the legitimate interest: C‑394/21, 11 Jan 2024 and C‑621/22, 11 Jan 2024.
• No “litigation fast-track”. The “right to evidence” does not replace Articles 5, 6 and 14 GDPR: information and an ex ante balancing test remain mandatory.
• Consent vs legitimate interest. The EDPB notes that in contexts with power imbalance (employee/employer), consent is rarely freely given; favour an objective basis or a strictly justified legitimate interest, with Art. 14 information if collection is indirect: Guidelines 05/2020.

What changes in practice

• Third‑party internal audits and investigations. If you rely on legitimate interest to access email metadata, IT logs or lists, you must: 1) precisely describe the interest pursued, 2) document necessity by data category, 3) perform the balancing test, 4) and, for indirect collection, provide Article 14 information explicitly stating “the legitimate interests pursued”. Otherwise, the legal basis is undermined.
• HR and disciplinary litigation. Trying to “cure” evidence ex post with the sole “right to evidence” is risky: without Article 14 information and demonstrable minimisation, production may be rejected.
• B2B marketing and third‑party leads. When using Art. 6(1)(f) for partner/aggregator databases, Article 14 requires clear and timely information, including the legitimate interests. CNPD guidance warns that legitimate interest is not a default basis.
• Security governance and IT logs. Using technical logs containing personal data for internal investigations requires a lawful basis and Article 14 information where data come from third parties; the balancing test must show proportionality and minimisation.

Next steps and compliance

Since 17 June 2026, relying on legitimate interest without full Article 14 information — and without a documented balancing test — exposes audits, evidence and data projects to immediate legal risk. To secure internal investigations, litigation and marketing in Luxembourg, consider structuring a DPO mandate and updating GDPR notices and records in line with CNPD expectations. For a localised approach, aligning with GDPR practice in Luxembourg helps tailor notices and balancing tests. Need hands‑on support? Get in touch with our team.

Official sources

• French Supreme Court, Commercial Chamber, 17 June 2026, No. 25‑11.499: Légifrance
• French Supreme Court, 1st Civil Chamber, 3 June 2026, No. 25‑14.228: Légifrance
• CNPD — lawfulness of processing: cndp.public.lu
• EDPB — Guidelines 05/2020 (consent): edpb.europa.eu
• CJEU — C‑394/21 (11.01.2024) and C‑621/22 (11.01.2024): eur-lex (C‑394/21) and eur-lex (C‑621/22)

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.