EU High Court: Transport Company Can't Require Passengers to Indicate Gender
Transport companies lack legitimate interest under the EU General Data Protection Regulation (GDPR) in requiring customers to indicate their title before purchasing train tickets, the European Court of Justice (ECJ) held in a preliminary ruling Thursday.
Sign up for a free preview to unlock the rest of this article
The case arose from the complaint of a rail passenger (identified as Mousse) who was required by French company NCF Connect to tick a title before purchasing travel documents, allowing NCF to personalize communications with the customer.
Mousse complained to French data protection authority CNIL; he argued that collecting such personal data was unlawful under the GDPR and violated the principle of data minimization and transparency obligations.
The CNIL found no infringement, saying instead that processing the data was necessary for the performance of the company's contract to provide transport services. Mousse appealed that decision to the Council of State, France, contending that title isn't necessary for the performance of a contract for transport services or for the purpose of a company's legitimate interests. That titles are used in commercial correspondence isn't sufficient to make such an obligation necessary, Mousse argued.
The complainant also argued that requiring passengers to indicate their gender infringes the right to travel without disclosing one's title, the right to respect for private life and the freedom to define one's gender expression, and that it risks discrimination. The French court asked the EU high court for a preliminary interpretation of the issues under the GDPR.
The ECJ found that collecting data on someone's title "does not appear to be either objectively indispensable or essential to enable the proper performance of a contract," so can't be deemed necessary for the performance of that contract. It also held that requiring a title to personalize communications is unnecessary for the data controller's legitimate interests when customers aren't informed of that legitimate interest; the data processing isn't carried out only as far as strictly necessary to attain that legitimate interest; and when in light of all the circumstances, someone's fundamental rights can prevail over the company's legitimate interests. That's particularly true when there's a risk of discrimination on the grounds of gender identity, the ECJ added. The case now returns to the French court.