DATA PROTECTION| The ECJ on processing of customers’ gender identity data

On 9 January 2024, the Court of Justice of the European Union (ECJ) issued its judgment in case C-394/23 (Mousse v CNIL, SNCF Connect) concerning the processing of customers’ gender identity data. The case involved SNCF Connect, a French railway company, which required customers to disclose their title (e.g., Mr or Ms) when purchasing tickets. The ECJ confirmed that a title constitutes personal data under the GDPR, as it reflects gender identity. To process such data lawfully, the ECJ emphasised the need for an appropriate legal basis under Article 6 GDPR, which in this case could be either contract performance or legitimate interest. With regard to the first legal basis, the ECJ ruled that processing gender identity data was not indispensable to fulfil a rail transport contract, as the service could be provided using neutral, inclusive terms without collecting such information. Collecting data merely because it is useful, rather than essential, violates the GDPR’s minimisation requirements. Regarding legitimate interest, the CJEU stressed the need to apply the three-step test, ensuring that processing is strictly necessary, does not infringe fundamental rights and avoids discrimination.

Newsletter n. 103 – January 2025