1/25
Preliminary ruling on data protection and ticketing
Preliminary ruling on data protection and ticketing
On 9 January 2025, the Court of Justice of the European Union (CJEU) under case C-394/23 issued a preliminary ruling deciding that a customer’s gender identity cannot be considered as necessary data for the purchase of a transport ticket
Background of the case:
The association “Mousse” challenged, before the French data protection authority (CNIL), the practice of SNCF Connect whereby the latter requires its customers to indicate their title (“Monsieur” or “Madame”, i.e. “Mr” or “Ms”) when purchasing transport tickets online. The association took the view that this requirement infringed the General Data Protection Regulation (GDPR), in particular the principle of data minimisation (Article 5(1)(c) GDPR), because an indication of the title, which corresponds to a gender identity, does not appear to be necessary for the purchase of a rail transport ticket.
In 2021, the CNIL decided to reject that complaint, finding that the practice did not constitute an infringement of the GDPR. Mousse disagreed with its decision and brought an action before the French Council of State seeking to have the decision of CNIL annulled.
The Council of State asked the CJEU for a preliminary ruling to establish whether, in particular, the collection of data regarding customers’ titles, limited to the titles “Monsieur” and “Madame” (“Mr” and “Ms”), could be classified as lawful and consistent with, in particular, the principle of data minimisation, where that collection is aimed at enabling personalised commercial communication with those customers, in accordance with commonly accepted practices in that field.
Judgement of the CJEU:
The CJEU reiterated that, in accordance with the principle of data minimisation (Article 5(1)(c) GDPR), which gives expression to the principle of proportionality, the data collected must be adequate, relevant and limited to what is necessary in the light of the purposes for which those data are processed. The Court also reiterated that the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful: that is so, inter alia, where it is (i) necessary for the performance of a contract to which the data subject is party, or (ii) necessary for the purposes of the legitimate interests pursued by the controller (here SNCF) or by a third party.
As regards the first of those two justifications (necessary for the performance of a contract), the CJEU decided that, for data processing to be regarded as necessary for the performance of a contract, that processing must be objectively indispensable in order to enable the proper performance of that contract. In that context, the CJEU found that personalisation of the commercial communication based on a presumed gender identity according to a customer’s title does not appear to be objectively indispensable in order to enable the proper performance of a transport contract. The railway undertaking could choose to communicate based on generic, inclusive expressions when addressing a customer, which have no correlation with the presumed gender identity of those customers. That would be a workable and less intrusive solution.
As regards the second justification for data processing (legitimate interest), the CJEU, whilst referring to its settled case-law on the matter, stated that the processing of data regarding the title of customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary (i) where those customers were not informed of the legitimate interest pursued when those data were collected; (ii) where the processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or (iii) where, in the light of all of the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular where there is a risk of discrimination on grounds of gender identity.
However, it is important to note that there are specific services, like night trains, where special compartments for female passengers are offered. This offer would therefore require the passenger’s gender to be indicated during the booking process. The court commented on this under points 41 and 42 of the decision, stating that these particular cases do not justify a general requirement for all passengers to disclose their sex / gender.
The respective French Court (French Council of State) must now decide on the specific case, taking into account the requirements of the CJEU.
