Consumers do not have to disclose their gender identity when buying a train ticket, ruled the Court of Justice of the European Union (CJEU) in a judgment handed down on Thursday 9 January (case C-394/23).
In France, invoking the principle of data minimisation enshrined in the ‘GDPR’ regulation (2016/679) governing the protection of personal data, an association is challenging the practice of the French railway undertaking SNCF Connect, which systematically requires its customers to indicate their title (‘Monsieur’ or ‘Madame’) (‘Mr’ or ‘Ms’) when purchasing tickets online.
Referred to the Court for a preliminary ruling by the French Council of State, the Court reiterates that the data collected must be adequate, relevant and limited to what is necessary for the purposes for which those data are processed.
The CJEU also reiterates that the ‘GDPR’ regulation sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful: that is so, inter alia, where it is (1) necessary for the performance of a contract to which the data subject is party, or (2) necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
As regards the first of these two justifications, the Court points out that, in order to be regarded as necessary for the performance of a contract, the processing of data must be objectively indispensable in order to enable it to be properly performed. In its view, personalising commercial communications based on a presumed gender identity according to the customer's title does not appear to be objectively indispensable in order to enable the proper performance of a rail transport contract. The railway undertaking could choose to communicate based on generic, inclusive expressions when addressing a customer, which have no correlation with the presumed gender identity of those customers, which would be a practical and less intrusive solution.
As regards the second justification, while referring to its settled case-law on the subject (Case C-252/21 - see EUROPE 13215/16), the Court states that the processing of data regarding the title of customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary (1) where those customers were not informed of the legitimate interest pursued when those data were collected; (2) where the processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or (3) where, in the light of all of the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular where there is a risk of discrimination on grounds of gender identity.
To see the judgment of the Court of Justice: https://aeur.eu/f/ezk (Original version in French by Mathieu Bion)