Personalisation of commercial correspondence and the necessity of processing data concerning gender for the performance of a contract – partially critical commentary on the judgment of the Court of Justice of the European Union of 9 January 2025 in Association Mousse v CNIL and SNCF Connect, C-394/23

Abstract

The judgment of the Court of Justice of the European Union (CJEU) of 9 January 2025 in Association Mousse v CNIL and SNCF Connect (C-394/23) concerns the compatibility with EU data protection law of requiring individuals to indicate their gender by selecting the forms “Mr” or “Ms” for the purpose of personalising commercial communications. This commentary adopts a partially critical perspective. The CJEU held that the personalisation of commercial communications based on gender identity is not necessary for the performance of a contract of carriage within the meaning of Article 6(1), first subparagraph, point (b), GDPR. The Court nevertheless accepted that such personalisation may be lawful on the basis of legitimate interests under Article 6(1)(f) GDPR, provided that the conditions set out in the judgment are met. This commentary does not challenge the case law of the CJEU or the European Court of Human Rights cited in the judgment concerning privacy-related aspects of gender identity, nor does it dispute the Court’s findings regarding the sale of travel documents as such. However, the CJEU also identified additional stages of contract performance beyond the electronic delivery of tickets that require commercial correspondence, including information on changes to the journey and communication with customer service (para. 37 of the judgment). As demonstrated by the linguistic research cited in this commentary, including statements of the Académie française, inflectional correctness is an element of linguistic correctness and intelligible communication. There are therefore grounds to rely on necessity for the performance of a contract under Article 6(1), first subparagraph, point (b), GDPR for gender-based personalisation of correspondence in contexts such as complaints and claims handling, where such personalisation follows the grammatical rules of the language concerned. Requiring information about such processing would imply that grammatically correct and intelligible correspondence falls outside the reasonable expectations of data subjects.