GDPR: CJEU Rules On Gender Identity Data In Rail Transport Ticket Purchases

GDPR

On January 9, 2025, the Court of Justice of the European Union ("CJEU") delivered its judgment in Case C-394/23, Mousse v. SNCF Connect. This marks a significant interpretation of the GDPR by underscoring the principle of data minimisation in the light of limiting the collection of personal data within commercial contexts to that which is strictly needed.

Background

The French railway operator, SNCF Connect ("SNCF"), required each of their customers to indicate their title (i.e. Mr or Ms) upon purchasing transport tickets online. The French Association Mousse argued that such a requirement contravened the GDPR. Specifically, the Association claimed that the data collection manifestly violated the principle of data minimisation, enshrined by article 5(1)(c) of the GDPR, as such information is not necessary for completing this specific transaction and is data which unnecessarily corresponds to gender identity.