Railway customers’ gender identity is unnecessary data for ticket purchasing

Photo credit: freepik

The association Mousse challenged the practice of French railway services, SNCF Connect, requiring and collecting the customers’ gender information by requesting their title (Monsieur/ Madame) upon purchasing online tickets, before the French data protection authority (CNIL). The association complained that SNCF Connect allegedly violated the principle of data minimisation; however, the CNIL refused and considered that there is no infringement in that case. Following the action brought by the association against the CNIL’s decision, the French Council of State asked the Court of Justice two questions: 

(1) Assessment of the adequacy, relevance, necessary limit of data collection within the meaning of Article 5(1)(c) of the GDPR and the need for processing in accordance with points (b) and (f) of [the first subparagraph of Article 6(1) of the GDPR], may account be taken of commonly accepted practices in civil, commercial and administrative communications, with the result that the collection of data relating to customers’ titles, which is limited to “Monsieur” or “Madame”, may be regarded as necessary, without this being precluded by the principle of data minimisation?

(2) Assessment of the need for the compulsory collection and processing of data relating to customers’ titles, even though some customers consider that they do not come under either of the two titles and that the collection of such data is not relevant in their case, should account be taken of the fact that those customers may, after having provided those data to the data controller in order to benefit from the service offered, exercise their right to object to the use and storage of those data by relying on their particular situation, in accordance with Article 21 of the GDPR?’

The Court recalled the principle of data minimisation and the principle of proportionality that: 

• “the data collected must be adequate, relevant and limited to what is necessary in the light of the purposes for which those data are processed”; and
• GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful: that is so, inter alia, where it is (i) necessary for the performance of a contract to which the data subject is party, or (ii) necessary for the purposes of the legitimate interests pursued by the controller or by a third party/ 

Accordingly, the Court considers that the processing must be objectively indispensable for the contract performance. Therefore, it finds that “personalisation of the commercial communication based on presumed gender identity according to a customer’s title does not appear to be objectively indispensable in order to enable the proper performance of a rail transport contract. The railway undertaking could choose to communicate based on generic, inclusive expressions when addressing a customer, which have no correlation with the presumed gender identity of those customers”.

Therefore, the necessity of collecting gender information from the railway ticket purchase cannot be proved in the following reasons: 

• Where those customers were not informed of the legitimate interest pursued when those data were collected;
• Where the processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or 
• Where in the light of all of the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular where there is a risk of discrimination on grounds of gender identity. 

Executive Summary: https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-01/cp250002en.pdf

Full-text Judgement:  https://curia.europa.eu/juris/document/document.jsf;jsessionid=DA52FED4A568EAE12D91D97698BC5B65?text=&docid=294110&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=1083977

For more discussions of personal data protection: https://astraiagear.com/category/data/personal-data-protection/

Follow us at https://www.linkedin.com/company/astraia-gear and connect with the author: https://www.linkedin.com/in/tranganhmac/