The Court of Justice of the European Union has ruled in Case C‑394/23 Mousse v CNIL and SNCF that asking customers to state their gender title (Mr or Ms) when buying train tickets is not necessary for the contract and may violate GDPR rules, especially the principle of data minimisation.
Mousse (a LGTB association) complained to the French data protection authority (CNIL) about the French railway company SNCF Connect, which requires customers to indicate their title (Mr or Ms) when purchasing tickets online. Mousse argued that this requirement breaches the GDPR because the title, which indicates gender identity, is not needed to buy a train ticket.
In 2021, CNIL rejected the complaint, stating that the practice did not violate the GDPR. Mousse disagreed and took the matter to the French courts, seeking to overturn CNIL’s decision.
The French courts referred the issue to the Court of Justice of the EU, asking if collecting customers’ titles for personalised commercial communication is lawful and consistent with the principle of data minimisation.
The Court of Justice has reiterated that, under the GDPR, data collected must be adequate, relevant, and limited to what is necessary for the purpose. The Court also stated that personalising commercial communication based on gender identity is not essential to fulfil a rail transport contract. The railway company could use generic, inclusive terms instead.
The Court further explained that processing personal data is lawful only if it is necessary for the contract’s performance or for the legitimate interests of the data controller or a third party. In this case, personalising communication based on gender identity is not necessary to perform the contract. Additionally, customers were not informed of the legitimate interest pursued, and the processing was not strictly necessary to achieve that interest. The fundamental rights and freedoms of customers, including the risk of gender identity discrimination, outweigh the legitimate interest.
