Written by Kieran Harte
Passengers should not have to provide their gender identity in order to buy a train ticket, the Court of Justice of the European Union (CJEU) has ruled in a case concerning the French rail network.
On January 9, 2025, the Court of Justice of the European Union (“CJEU”) issued a decision (Case C-394/23) on the GDPR’s lawfulness and data minimisation principles.
The case arose from a complaint made by Association Mousse in 2021 to the French data protection authority, Commission nationale de l’informatique et des libertés (CNIL), against SNCF Connect, which required customers to indicate their title, by ticking ‘Monsieur’ or ‘Madame’ (‘Mr’ or ‘Ms’) when purchasing travel documents online. Mousse argued that the requirement infringed the General Data Protection Regulation (GDPR), in particular in the light of the principle of data minimisation, because it didn’t appear to be necessary provide their title, which corresponds to a gender identity, to buy a rail ticket online. More specifically, Mousse alleged that the collection of those data by SNCF Connect infringed the principles of lawfulness and data minimisation as well as the obligations of transparency and provision of information arising from the GDPR.
This requirement has led to transgender passengers being fined during ticket inspections by SNCF staff. For example, a passenger traveling from Lyon to Paris in 2013 was fined €227 because the gender appearing on her national ID card and the train ticket did not match her physical appearance (the fine was subsequently refunded by SNCF). It is not uncommon for transgender individuals during their gender transition to hold identity documents that do not align with the gender in which they present themselves.
CNIL decided not to uphold the complaint, and Mousse appealed the CNIL’s decision before the French Administrative Supreme Court (“Conseil d’Etat”), which stayed the proceedings to refer some questions to the CJEU. In such cases, the CJEU does not decide the dispute itself. The national court will make a determination on the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
The French court asked the CJEU, firstly, whether, in particular, the collection of data regarding customers’ titles, limited to the titles ‘Monsieur’ and ‘Madame’ (‘Mr’ and ‘Ms’), can be classified as lawful and consistent with, in particular, the principle of data minimisation, where that collection is aimed at enabling personalised commercial communication with those customers, in accordance with commonly accepted practices in commercial, civil and administrative communications, and, secondly, those customers could, after providing those data to the controller, exercise their right to object to the use of such data, for reasons relating to their particular situation.
The CJEU held that “the common practice in civil, commercial, and administrative communications” invoked by SNCF does not justify collecting data on gender identity. Moreover, the court found that personalisation of customer communications did not objectively need to be based on the customer’s gender identity to enable the performance of the a rail contract. SNCF Connection could have chosen to communicate based on generic, inclusive expressions when addressing those customers, with no correlation to the latter’s presumed gender identity, as a workable and less intrusive solution.
Additionally, in relation to legitimate interest, the court concluded that the practice cannot be regarded as necessary where those customers were not informed of the legitimate interest pursued when the data was collected, where the processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest, or where, in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
Finally the court found that the existence of a right to object cannot be taken into consideration for the purposes of assessing lawfulness and, in particular, the need to process personal data based on the legitimate interests pursued by the controller or by a third party. The reason is that the CJEU considered that the right to object presupposed that the processing is lawful (i.e. that there is a legal basis). In other words, the lawfulness of such processing should not depend on the existence of a right to oppose.
The case will now continue before the French Council of State.
Possible implications for organisations
It is important to clarify that the CJEU’s ruling does not completely prohibit the collection of gender identity data. Firstly, if organisations choose to indicate “Mr.” or “Ms.” on an optional basis, the collection of such data is lawful. Secondly, in certain situations, collecting gender identity information is justified, such as ensuring compliance with gender parity rules or for specialised healthcare purposes.
Generally, it is recommended to avoid asking individuals for their personal title unless there is a specific reason for doing so. If an organisation chooses to indicate “Mr.” or “Ms.” on a mandatory basis on forms or uses presumed gender titles when processing personal data, they must find a legal basis to justify this processing. Otherwise, organisations should consider revising their forms or using generic, inclusive expressions instead.
An example of a generic, inclusive expression is the prefix “Mx” (pronounced ‘mux’ or ‘mix’) or using the person’s name instead of Mr/Mrs/Ms. The prefix “Mx” is a gender-neutral title of courtesy used by individuals who prefer not to disclose their gender or who identify as gender non-binary. Alternatively, in Ireland, “a chara” (friend) or “[Forename], a chara” may also be used in correspondence.
As noted by the CNIL in its submission to the CJEU:
“If the processing of the title of address were to be prohibited or made subject to users’ choice, any mention of ‘Ms.,’ ‘Madam,’ ‘Mr.,’ ‘Mister,’ ‘M,’ or ‘F’ would have to be removed from all everyday documents to name but a few: criminal complaints, police reports, police or gendarmerie statements, medical prescriptions, residence permits, passports, etc. Any change to such standard practices should be introduced only through legislation.”
Useful links
Complaint lodged with the CNIL against SNCF on January 12, 2021
CNIL decision of March 23, 2021
Conseil d’État ruling of June 21, 2023 (preliminary reference)