The case arose from a complaint made by a group called Mousse to the French data protection authority against SNCF Connect, which requires customers to indicate their title — ‘Monsieur’ or ‘Madame’ — when purchasing transport tickets online.

Mousse argued that the requirement infringes the GDPR, in particular in the light of the principle of data minimisation, because there was no clear reason why a customer was required to provide their title, and therefore gender identity, to travel.

The French data protection authority rejected the complaint in 2021, finding that the practice did not constitute an infringement of the GDPR.

Mousse disagreed with that decision and brought an action before the French Council of State seeking to have the decision annulled.

The French court subsequently asked the CJEU whether the collection of data regarding customers’ titles can be classified as lawful and consistent with the principle of data minimisation where that collection is aimed at enabling personalised commercial communication with those customers.

In yesterday’s ruling, the court reiterated that, in accordance with the principle of data minimisation, which gives expression to the principle of proportionality, the data collected must be adequate, relevant and limited to what is necessary in the light of the purposes for which those data are processed.

The court also reiterated that the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful, including where it is necessary for the performance of a contract to which the data subject is party, or where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

In regard to the first of those two justifications, the court reiterated that, for data data processing to be regarded as necessary for the performance of a contract, that processing must be objectively indispensable in order to enable the proper performance of that contract.

The court found that personalisation of the commercial communication based on presumed gender identity according to a customer’s title did not appear to be objectively indispensable in order to enable the proper performance of a rail transport contract.

SNCF Connection could choose to communicate based on generic, inclusive expressions when addressing a customer, which have no correlation with the presumed gender identity of those customers. That would be a workable and less intrusive solution, the court found.

On the second justification, the court highlighted its settled case law in finding that the practice could not be regarded as necessary in the circumstances.

Customers were not informed of the supposed legitimate interest pursued when the data was collected, the processing was not carried out only insofar as strictly necessary for the attainment of that legitimate interest, and the legitimate interest could not prevail over the risk of discrimination on grounds of gender identity.

The case will now continue before the French Council of State.