Background
Orange SA, the French telecommunications group, maintains a fifteen-member board of directors that includes, by statute and company agreement, one representative elected by employee shareholders. When that seat came up for renewal, two candidate pairs competed in early 2024: Mme [N] and M. [G], backed by the F3C-CFDT union and the employee-shareholder association AASGO, and M. [E] and Mme [C], backed by the CFE-CGC Orange union. Voting proceeded in two rounds: in the first round on January 26, 2024, the [N]/[G] pair obtained 50.70% of votes; in the second round held February 5–9, 2024, the [E]/[C] pair reversed course and won with 55.07%. The gap between the two pairs in the second round corresponded to roughly 2,171 voters, or about 10.14 percentage points.
Alleging irregularities, the F3C-CFDT and Mme [N] brought proceedings before a commercial court seeking annulment of the second round. A key piece of evidence was a technical report commissioned by Orange’s board from the audit firm EY to investigate claims that employee personal data had leaked and been used illicitly during the campaign. EY accessed email metadata and electoral rolls containing personal data, pseudonymized all of it, destroyed the original data (which did not include email content), and performed a purely volumetric statistical analysis that generated no nominative files. Five bailiff’s reports documented EY’s process. The Versailles Court of Appeal, on December 10, 2024, admitted the EY report into evidence and annulled the second round, finding that CFE-CGC’s campaign communications had been mendacious and virulent, exceeding the permissible bounds of trade-union free expression and electoral debate, and had distorted the result. CFE-CGC Orange, M. [E], Mme [C], and the employee-shareholder defense association ADEAS appealed to the Court of Cassation on three grounds.
The first ground challenged the admissibility of the EY report under the GDPR, arguing that Orange, as data controller, had failed to inform employees of the legitimate interests pursued before their data was processed indirectly, as required by Article 14 GDPR, and that pseudonymization does not excuse the notification obligation. The second ground challenged the annulment itself on two sub-points: (i) that inflammatory campaign statements can only exceed permissible limits if the opposing party was unable to reply before the vote, and (ii) that the 10.14-point margin in the second round was too substantial to constitute a “narrow gap” that could be attributed to the alleged misconduct.
The Court’s Holding
The Court of Cassation rejected all grounds and dismissed the appeal in full. On the GDPR admissibility question, the Court reaffirmed the principle drawn from Article 6 § 1 of the European Convention on Human Rights and Article 9 of the Code of Civil Procedure: in civil proceedings, the unlawful or disloyal manner in which evidence was obtained does not automatically require its exclusion. The judge must balance the right to evidence against competing rights — here, data privacy and trade-union freedom — and may admit the evidence if its production is indispensable and the resulting infringement is strictly proportionate to the goal pursued. The Court found that EY’s methodology — pseudonymization, destruction of originals, and purely volumetric analysis with no nominative output — reduced the intrusion on personal data and trade-union confidentiality to an extremely limited level. The Versailles court’s proportionality assessment was therefore legally sound, rendering the first and second GDPR sub-grounds ineffective (inopérant) and the third sub-ground unfounded.
On the electoral grounds, the Court characterized the challenge as an impermissible attempt to revisit the sovereign factual assessment of the lower courts. The Versailles judges had correctly applied general principles of electoral law, finding on the one hand that CFE-CGC’s campaign messaging was sufficiently false and aggressive to exceed acceptable limits of union expression and electoral polemic, and on the other that this misconduct and the resulting breach of equal campaign means had distorted the outcome. The Court upheld that analysis, emphasizing two key factors: the dramatic inversion of results between rounds in only two weeks, and the relatively small share of the electorate that separated the two pairs when measured against the full body of eligible voters — notwithstanding the raw percentage-point gap of over ten points.
The Court ordered CFE-CGC Orange, M. [E], Mme [C], and ADEAS to pay costs and to pay Orange SA a global sum of €3,000 and Mme [N] and the F3C-CFDT a further global sum of €3,000 under Article 700 of the Code of Civil Procedure.
Key Takeaways
- In French civil litigation, GDPR violations in evidence-gathering do not automatically exclude that evidence; courts apply a proportionality balancing test weighing the right to evidence against the severity of the data-protection infringement.
- Thorough pseudonymization, destruction of source data, and a volumetric (non-nominative) analysis can reduce the weight of a GDPR objection to evidence sufficiently for a court to admit it under the right-to-proof doctrine.
- Under French general electoral law principles, campaign communications that are mendacious and virulent beyond the limits of permissible polemic can vitiate an election result even where the winning margin appears numerically significant, provided the result inversion is sudden and the margin is small relative to the total electorate.
- The “narrow gap” test for electoral annulment is assessed in proportion to the entire electorate, not solely in absolute percentage-point terms — a gap that looks large in isolation may still be deemed narrow enough to justify annulment if context (such as a dramatic swing over a short campaign period) supports that inference.
Why It Matters
This decision is significant for French corporate governance and labor law because it clarifies the interplay between GDPR compliance and litigation evidence rights in the specific context of internal corporate elections. Companies that commission forensic or technical analyses involving employee data during electoral disputes now have Court of Cassation authority confirming that such reports can be admitted if robust privacy-protective measures — pseudonymization, data destruction, and non-nominative output — are in place and documented, provided the right to evidence makes production indispensable. The decision gives practical guidance on how to structure such investigations to withstand GDPR challenges.
More broadly, the ruling reinforces that French courts will scrutinize employee-shareholder board elections with the full toolkit of general electoral law, including the power to annul results tainted by disproportionately aggressive or false campaign conduct. For trade unions and employee representative bodies, the case is a reminder that the latitude afforded to robust campaigning has limits, and that a rapid and large swing in voter preference across a very short campaign can itself serve as circumstantial evidence that improper conduct distorted the outcome.