Is it really necessary to ask for gender when purchasing tickets online, or does this constitute a disproportionate interference with the right to informational self-determination? The European Court of Justice (ECJ) had to rule on this issue (judgment of 9 January 2025, ref.: C-394/23).
The case
The preliminary ruling proceedings centred on the French railway company SNCF Connect, which required its customers to identify themselves as either “Monsieur” (Mr) or “Madame” (Mrs) when purchasing tickets online.
The association Mousse, which fights against sexual discrimination, subsequently filed a complaint with the French data protection supervisory authority CNIL. In the association’s view, this practice violates the General Data Protection Regulation (GDPR), in particular the principle of data minimisation, as a gender-specific form of address is by no means necessary for the mere sale of tickets.
However, the data protection authority did not consider this to be a violation and deemed the collection of address data to be lawful, as it was necessary for the performance of the contract. The Mousse association then appealed to the Conseil d’État, the highest administrative court in France, which referred the question to the ECJ for a preliminary ruling.
Current judgements on the GDPR
Read our regular reviews of data protection law rulings to stay up to date!
The ruling
The ECJ ruled that the mandatory request for a title (“Mr” or “Ms”) in the online sale of train tickets cannot be based on a valid legal basis and therefore violates the GDPR.
In its decision, the ECJ makes it clear that the GDPR contains an exhaustive list of permissible reasons for processing. In this case, both the performance of a contract pursuant to Art. 6(1)(b) GDPR and the legitimate interest pursuant to Art. 6(1)(f) GDPR are potential legal bases for data processing.
With regard to the performance of a contract, the ECJ states that gender-specific forms of address are “not objectively indispensable” for the performance of the rail transport contract, as polite forms of address without gender specification are also possible. Thus, the form of address data is not necessary for the performance of a contract.
Furthermore, this data is also not necessary for the protection of the legitimate interests of the controller. The ECJ emphasises that a gender-specific form of address cannot be based on legitimate interest
- if the data subjects were not informed in advance of the legitimate interests pursued,
- if the data processing is not strictly necessary, or
- if the overriding interests of the data subjects conflict with the interests of the company. In the present case, such an overriding interest may consist in preventing discrimination on the basis of gender identity.
The mandatory request for a form of address is therefore inadmissible. Instead, companies could use general and gender-neutral forms of address without interfering with the gender identity of their customers.
Data protection assessment
According to the principle of data minimisation, only personal data that is essential for the respective processing purpose may be collected. However, this does not mean that any processing of title data is prohibited, but rather that companies must carefully check whether this data is actually only collected when it is objectively essential.
The ruling makes it clear that no controller may tacitly invoke the legitimate interest pursuant to Art. 6(1)(f) GDPR if this has not been specifically identified and weighed up.
At the same time, the German Federal Court of Justice (BGH) clarified in its decision of 27 August 2024 (Ref.: X ZR 71/22) that Deutsche Bahn must design its online booking platform in such a way that non-binary persons can also be addressed without being forced to choose between “Mr” or “Ms”. Otherwise, this would also constitute a violation of the GDPR.
Recommendations for action for controllers
The collection of salutation data is only permissible if it is necessary for the performance of a contract or if there is a legitimate interest. Companies are required to check whether the data collected is really needed. At the same time, controllers should check their online forms to see whether the title is marked as a mandatory field.
If this is the case, it is advisable to either delete the field completely or make it optional. If no (voluntary) selection is made, polite phrases that do not specify gender can be used.
This issue is not only relevant for online ticket sales, but can be applied to all industries in which companies have traditionally used gender-specific forms of address.
Conclusion
The ECJ is sending a clear signal: the processing of salutation data is only permissible if it is objectively essential. The protection of privacy must not take a back seat to market or image-related interests. Even if a company pursues legitimate interests, these must be presented transparently and weighed against the rights of the data subjects.