In a judgment of 9 January 2025, the Court of Justice clarifies the conditions under which a form of address indicating gender identity may be requested under the General Data Protection Regulation (GDPR). In doing so, it explicitly links this issue to anti-discrimination law.
1. The case concerns the practice of the French railway company SNCF to request a form of address by default when purchasing tickets online. Customers are required to select either “Mr” or “Mrs” when making a purchase. According to the applicant, this practice violates the General Data Protection Regulation (GDPR).
2. The purpose of the GDPR is to ensure a high level of protection for personal data. In line with this objective, any processing of personal data must be based on a lawful ground as defined by the GDPR. Personal data must be processed lawfully, fairly, and transparently in relation to the data subject. Lastly, the principle of data minimisation applies: processing must be limited to what is necessary for the purposes for which the data are processed.
3. The French Council of State asked the Court of Justice whether SNCF's practice could be based on a lawful ground under Article 6 of the GDPR, namely “necessary for the performance of a contract” or “necessary for the purposes of legitimate interests.” The Council of State had already ruled out the grounds of “legal obligation” and “consent.”
4. Regarding the first legal ground (necessity for the performance of a contract), SNCF argued that it needed the form of address for its commercial communication, as tickets are sent electronically.
The Court of Justice rejected this argument. It held that a practical and less intrusive alternative exists, namely a generic, inclusive form of salutation from which gender identity cannot be inferred. SNCF was found to already use such formulations (such as “Thank you, have a good trip” or “Good morning”). Therefore, it is not necessary to mandatorily request a form of address.
5. Regarding the second legal ground (necessity for the purposes of legitimate interests), SNCF argued that direct marketing is a legitimate interest, which would justify requesting a form of address when purchasing train tickets.
The Court of Justice recognised that direct marketing can indeed be a legitimate interest. However, it held that a customer’s form of address is not necessary for direct marketing purposes, as SNCF can suffice with first and last names. The Court emphasised the principle of data minimisation.
The Court then weighed the interests and rights of the data subject. It found that a data subject does not expect a company to process data about their form of address or gender identity in the context of purchasing a travel ticket. Furthermore, the Court ruled that the French Council of State must assess whether there is a risk of discrimination based on gender identity, as referred to in the Gender Directive (Directive 2004/113). In particular, the Court pointed to discrimination based on a change in a person’s gender identity.
6. With this judgment, the Court of Justice for the first time provides a set of guidelines for the processing of personal data relating to gender identity and gender transition. The Court closely examines whether requesting such data is genuinely necessary for the stated purpose.
In this case, the Court concluded that requesting a form of address is not necessary either for the performance of the contract or for the pursuit of a legitimate interest. Importantly, in this case, indicating a form of address was mandatory in order to purchase an online ticket and limited to either “Mr” or “Mrs.” The Court did not yet rule on practices in which indicating a form of address is optional or where more options are available.
Finally, it is notable that the Court dealt with this case exclusively under Article 6 of the GDPR, which concerns the legal grounds of “performance of a contract” and “legitimate interest.” In doing so, the Court implicitly indicates that gender identity is not in itself a special category of personal data within the meaning of Article 9 of the GDPR. Article 9 is stricter and does not allow processing based on “performance of a contract” or “legitimate interest.”
Given the definition of special categories of personal data, we believe it is correct that gender identity in itself is not covered by Article 9 GDPR. However, the Court also points to the risk of discrimination based on a change in gender identity. A change in gender identity may indicate a diagnosis of gender dysphoria, which could be considered “health data” and thus a special category of personal data. Nevertheless, the Court of Justice currently remains within the scope of Article 6 GDPR. This means that, in theory, it remains possible to process data about (a change in) gender identity on the basis of “performance of a contract” or “legitimate interest.”