The French railway company SNCF Connect had a practice of requiring customers to specify their title as “Monsieur” or “Madame” when purchasing train tickets online. The French data protection authority deemed this practice lawful, citing its necessity for fulfilling the transport service contract. They also argued that the practice aligned with the principle of data minimization, as addressing customers personally with a title is an accepted practice in commercial communication. However, before the CJEU, it was argued that forcing customers to disclose a title was neither necessary to fulfill the transport contract nor for SNCF Connect’s legitimate interests, and it could lead to discrimination, particularly for individuals with non-binary gender identities.
The CJEU assessed whether the practice of collecting customers’ titles could be considered necessary for fulfilling a contract or for legitimate interests, in accordance with the GDPR. The court concluded that personalizing communication based on the customer’s gender identity was not objectively necessary to fulfill the contract. They pointed out that less intrusive alternatives exist, such as using generic and inclusive expressions in communication.
Furthermore, the court evaluated whether the processing of personal data could be justified based on legitimate interests. They emphasized that such interests must be clearly communicated to customers, and the processing must be strictly necessary to achieve these interests. The court found that SNCF Connect had not met these requirements, particularly since customers were not informed about the legitimate interests, and there was a risk of discrimination based on gender identity.
The ruling illustrates how the necessity requirement present in many grounds for processing personal data should be applied. Additionally, it shows how a balancing of interests can be affected by non-compliance with the GDPR’s information obligations, and how a personal data point like gender identity, which is unproblematic for most, can be significantly more sensitive for certain groups and pose a risk of discrimination.
