At the start of the new year, the European Court of Justice (ECJ) was tasked with reviewing whether it was permissible under European data protection law for a French railway company to require customers to provide information on their gender identity (Mr/Mrs) via a mandatory field in its online ticket booking platform (e.g. for the performance of a contract within the meaning of Art. 6(1) sentence 1 (b) GDPR or for the purposes of legitimate interests within the meaning of Art. 6(1) sentence 1 (f) GDPR).
The key points of the court’s judgment issued on 9 January 2025 (Case C-394/23) were as follows:
- While properly addressing customers is necessary in commercial communication within the meaning of Art. 6(1) sentence 1 (b) of GDPR (performance of a contract or precontractual measures), such communication does not have to be personalised based on the gender identity of the customer concerned in order to perform or initiate a contract. Requiring customers to provide information on their gender identity can therefore not be justified on the basis of Art. 6(1) sentence 1 (b) GDPR.
- With regard to the question whether requiring customers to indicate their gender identity is necessary for the purposes of legitimate interests within the meaning of Art. 6(1) sentence 1 (f) GDPR, the ECJ makes this subject to strict requirements that are to be assessed by balancing the opposing rights and interests in question. Customers must also be informed of the legitimate interest when the data is collected – for example via a privacy notice. Whether requiring customers to provide information on their gender is permissible under data protection law on the basis of a legitimate interest of the controller therefore depends largely on the specific circumstances and must be carefully examined.
The judgment does not affect the ability of companies to request information on gender identity on a voluntary basis. If providing such information is voluntary, there should generally be fewer risks from a data protection law perspective.
Businesses should therefore review their information request forms (e.g. in online order or registration processes) in light of the ECJ judgment and make the necessary adjustments.
