Court of Justice: no gender information required to purchase a train ticket
The Court of Justice has ruled that companies are not always allowed to enquire about customers' gender identity. Collecting data on customer titles, such as ‘Mr’ or ‘Ms’, is not always necessary, especially if the purpose is to personalise ads.
Complaint about French train company SNCF
French organisation Mousse filed a complaint with the French privacy watchdog about the practices of railway company SNCF Connect. Mousse argued that SNCF should not ask customers whether they are male or female when they buy a train ticket, positing that this is prohibited under the European Data Protection Regulation (GDPR). According to Mousse, picking a title linked to a gender identity is not necessary in the context of buying a train ticket.
Lawsuit in France
After the French privacy watchdog rejected Mousse's complaint, Mousse took the case to court. Ultimately, the French Council of State, which ensures that laws and regulations are properly applied, petitioned the European Court of Justice for an opinion on whether enquiring about titles, such as ‘Mr’ or ‘Ms’, is permitted under the GDPR.
Court of Justice ruling
The Court ruled that, following the principle of data minimisation, companies may only collect data that are necessary. This means that the data must be relevant and suitable for achieving a specific purpose. Companies are therefore not allowed to ask for more information than is needed. While gender identity might be relevant for assigning night train compartments, it is not appropriate to request this information from passengers travelling only during the day.
When is collecting personal data permitted?
- If it is necessary to deliver a product or service, (e.g. buying a train ticket)
- If it is necessary for a legitimate business interest - but only if that interest outweighs the rights and freedoms of the customer
What is and is not necessary?
According to the Court, personalising ads or communications based on an individual's gender identity is not necessary in the context of selling a train ticket. The train company can also address customers with general, gender-neutral words. This is less intrusive and works just as well.
The Court also ruled that collecting customer titles (such as Mr or Ms) is not necessary if:
- Customers are not properly informed about why the data are being collected
- The data are not really needed for the stated purpose
- The practice could lead to issues such as gender discrimination
The Court stressed that companies must consider the rights and freedoms of customers and should first assess whether their purpose can be achieved in less intrusive ways.
Want to know more?
The full ruling C-394/23, can be found on the InfoCuria website (Court of Justice case law) CURIA - Documents (europa.eu).