GDPR and rail transport: A customer’s gender identity is not necessary data for the purchase of a transport ticket

In its judgment in Case C-394/23 (Mousse) the EU Court of Justice ruled that a rail transport customer’s gender identity is not necessary data for the purchase of a transport ticket.

The collection of data regarding customers’ titles is not objectively indispensable, in particular where its purpose is to personalise commercial communication. 

The association Mousse challenged, before the French data protection authority (the CNIL), [1] the practice of the French railway undertaking SNCF Connect whereby the latter systematically requires its customers to indicate their title (‘Monsieur’ or ‘Madame’) (‘Mr’ or ‘Ms’) when purchasing transport tickets online. That association takes the view that that requirement infringes the General Data Protection Regulation (GDPR), [2] in particular in the light of the principle of data minimisation, because an indication of the title, which corresponds to a gender identity, does not appear to be necessary for the purchase of a rail transport ticket. 

In 2021, the CNIL decided to reject that complaint, finding that that practice did not constitute an infringement of the GDPR. Mousse disagreed with that decision and brought an action before the French Council of State seeking to have the decision annulled. The Council of State asks the Court of Justice whether, in particular, the collection of data regarding customers’ titles, limited to the titles ‘Monsieur’ and ‘Madame’ (‘Mr’ and ‘Ms’), can be classified as lawful and consistent with, in particular, the principle of data minimisation, where that collection is aimed at enabling personalised commercial communication with those customers, in accordance with commonly accepted practices in that field. 

The Court reiterates that, in accordance with the principle of data minimisation, which gives expression to the principle of proportionality, the data collected must be adequate, relevant and limited to what is necessary in the light of the purposes for which those data are processed. 

The Court also reiterates that the GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful: that is so, inter alia, where it is (i) necessary for the performance of a contract to which the data subject is party, or (ii) necessary for the purposes of the legitimate interests pursued by the controller or by a third party. [3] 

As regards the first of those two justifications, the Court reiterates that, for data processing to be regarded as necessary for the performance of a contract, that processing must be objectively indispensable in order to enable the proper performance of that contract. In that context, the Court finds that personalisation of the commercial communication based on presumed gender identity according to a customer’s title does not appear to be objectively indispensable in order to enable the proper performance of a rail transport contract. 

The railway undertaking could choose to communicate based on generic, inclusive expressions when addressing a customer, which have no correlation with the presumed gender identity of those customers. That would be a workable and less intrusive solution. 

As regards the second justification, the Court, whilst referring to its settled case-law on the matter, states that the processing of data regarding the title of customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary (i) where those customers were not informed of the legitimate interest pursued when those data were collected; (ii) where the processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or (iii) where, in the light of all of the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular where there is a risk of discrimination on grounds of gender identity. (curia.europa.eu/photo freepik.com)

_____________

1 Commission Nationale de l'Informatique et des Libertés. 

2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 

3 The GDPR contains other grounds on which processing of data can be regarded as lawful. However, the French Council of State refers exclusively to those two justifications

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Intellectual property: the figurative sign consisting of the phrase ‘RUSSIAN WARSHIP, GO F* *K yourself’ in Russian and English cannot be registered as an EU trade mark

Image
In its Judgment in Case T-82/24 (Administration of the State Border Guard Service of Ukraine v EUIPO) (RUSSIAN WARSHIP, GO F**K YOURSELF) the General Court ruled that the figurative sign consisting of the phrase ‘RUSSIAN WARSHIP, GO F* *K yourself’ in Russian and English cannot be registered as an EU trade mark. That phrase, which has become a symbol of Ukraine’s fight against Russian aggression, is not perceived as an indication of a commercial origin.  The Administration of the State Border Guard Service of Ukraine (Kyiv, Ukraine) requests the General Court of the European Union to annul the decision of the European Union Intellectual Property Office (EUIPO) of 1 st December 2023, which refused registration of the following figurative sign as an EU trade mark: ‘RUSSIAN WARSHIP, GO F* *K yourself’ That mark is a war cry uttered by the Ukrainian border guard on Snake Island on 24th February 2022, the first day of the full-scale Russian invasion of Ukraine. Registration was sou...
Read more

Prohibiting contact between children and their mother in custody and contact rights case was unjustified (ECtHR)

Image
The case of X and Others v. Slovenia (application nos. 27746/22 and 28291/22) concerned custody decisions and contact rights following the separation of X from her children’s father in 2018. It also concerned the reassignment of X’s court case to a particular judge.  In Chamber's judgment in the case, the European Court of Human Rights held, unanimously, that there had been a violation of Article 6 § 1 (right to a fair trial) of the European Convention on Human Rights, as regards X’s right to a tribunal established by law, and violations of Article 8 (right to respect for private and family life) with respect both to:  - the applicant children, as regards the order to remove them from X’s (their mother’s) care in March 2020, their not being represented in the contact and custody proceedings, and their not being allowed contact with their mother;  - X, for not being allowed contact with her children.  The Court found in particular that the President of the District Co...
Read more

ECtHR elects a new Vice-President of the Court and two new Section Presidents

Image
The European Court of Human Rights has elected on 23.9.2024 a new Vice-President of the Court – Judge Ivana Jelić (elected in respect of Montenegro). She will take up her duties on 1 November 2024.  The Court has also elected at the same date two new Section Presidents – Judges Lado Chanturia (elected in respect of Georgia) and Ioannis Ktistakis (elected in respect of Greece). They will also take up their duties on 1 November 2024. Ivana Jelić was born on 17 March 1975 in Podgorica, Montenegro and was elected Judge of the European Court of Human Rights on 12 July 2018. Lado Chanturia was born on 14 April 1963 in Tsalenjikha, Georgia, was elected Judge of the European Court of Human Rights on 8 January 2018 and is Vice-President of Section since 18 May 2023. Ioannis Ktistakis was born on 3 January 1971 in Thebes, Greece and was elected Judge of the European Court of Human Rights on 8 March 2021. (source/photo: echr.coe.int) Read more here
Read more

European Data Protection Board clarifies rules for data sharing with third country authorities and approves EU Data Protection Seal certification

Image
During its latest plenary, the European Data Protection Board (EDPB) published  guidelines on Art.48 GDPR  about data transfers to third country authorities and  approved a new European Data Protection Seal. Αs stated in a press release from the EDPB, in a highly interconnected world, organisations receive requests from public authorities in other countries to share personal data. The sharing of data can, for instance, be of help to collect evidence in the case of crime, to check financial transactions or approve new medications. When a European organisation receives a request for a transfer of data from a ‘third country’ (i.e. non-European countries) authority, it must comply with the General Data Protection Regulation (GDPR). In its guidelines, the EDPB zooms in on Art. 48 GDPR and clarifies how organisations can best assess under which conditions they can lawfully respond to such requests. In this way, the guidelines help organisations to make a decision on whether...
Read more

Insufficient safeguards in national law to protect data in seized lawyer’s mobile phone (ECtHR)

Image
In its committee judgment in the case of Nezirić v. Bosnia and Herzegovina (application no. 4088/21) the European Court of Human Rights held, unanimously, that there had been a violation of Article 8 (right to respect for correspondence) of the European Convention on Human Rights.  The case concerned the seizure and examination of a lawyer’s mobile phone in the context of a criminal investigation against him. The Court was particularly concerned about the practical framework for the protection of legal professional privilege in cases such as this. Mr Nezirić’s phone was seized in his office and its entire contents copied, transferred and examined elsewhere, without either Mr Nezirić or a member of the Bar Association present. The data retrieved had subsequently been sifted through, but without any judicial supervision. Moreover, the entire copied contents of the phone had ultimately been submitted as evidence at trial, and not the sifted data. Principal facts  The applicant, S...
Read more

A national court is not required to apply a decision of its constitutional court that infringes EU law (ECJ)

Image
In its Judgment of 26.9.2024 in Case C-792/22 (Energotehnica) the Court of Justice ruled as regards the right to an effective remedy that a national court is not required to apply a decision of its constitutional court that infringes EU law. In such a case, the national court may not be penalised.  Following the death of an electrician by electrocution during a maintenance operation, an administrative procedure was initiated against his employer. At the same time, criminal proceedings for negligence and manslaughter were initiated against the supervisor. The victim’s next of kin also became civil parties to the criminal proceedings.  The administrative court hearing the dispute concluded that the present case did not involve an ‘accident at work’. It annulled the administrative penalties imposed on the employer. According to national legislation, as interpreted by the Romanian Constitutional Court, that administrative decision prevents the criminal court from reconsidering whe...
Read more