Menu

Filter by
content
PONT Data&Privacy
  • PONT home
    • mill

    0

    AVG
    De AVG regelt de rechten en verplichtingen rond persoonsgegevens die op basis van een verwerkingsgrondslag uit de AVG worden verwerkt.

    'Dear person' - often not a valid basis for gender in online forms

    When creating an account or filling out an online form, it is common to be asked for address titles based on a person's gender. However, on Jan. 9, 2025, the European Court of Justice (the Court) ruled that there is often no valid basis for the collection of address titles. The case was brought by the association Mousse ("Mousse") against the French Data Protection Authority ("CNIL") and SNCF (the French Railways). With the judgment, the Court ticked off both the SCNF and the French Personal Data Authority. The latter had rejected Mousse's complaint in this regard.

    Martin Hemmer

    January 31, 2025

    Blog

    Blog
     
    The result of the ruling is that many online forms are not compliant with the AVG.

    Case Background

    Mousse argued that the mandatory choice between the address titles "Mr." and "Ms." when filling out online forms to buy train tickets violated the AVG and the principles of equal treatment and non-discrimination. Mousse argued that this practice not only violates data protection principles but also constitutes a form of gender discrimination because it does not take into account people who do not identify as male or female.

    The argument of CNIL and SNCF

    CNIL and SNCF defended the practice by arguing that the collection of address titles was necessary for the performance of the agreement and was a common commercial practice. They argued that address titles were essential for customer-friendly communication and avoiding confusion when addressing customers.

    The Court's questions and opinion

    The first preliminary question asked whether the AVG must be interpreted as meaning that the processing of personal data relating to the address title of a transport undertaking's customers, which aims at personalized commercial communications based on their gender identity, can be considered necessary for the performance of a contract, within the meaning of this point (b), or for the protection of the legitimate interests of the controller or of a third party, within the meaning of this point (f). The Court emphasized that such data may only be collected if they are necessary for a specific, clearly defined and legitimate purpose: The processing of personal data must be "objectively indispensable to achieve an objective which is an integral part of the contractual performance to be provided to the data subject." That requirement leaves little wiggle room. Accordingly, the Court concludes that no such necessity exists for French Railways' customers. The Court is further of the opinion "subject to verification by the court of fact" that legitimate interest (Art. 6(1)(f)) cannot be invoked as a basis either. Communication can also take place purely on the basis of surname and first name. Customers of French Railways need not assume that their gender identity will be processed in the context of purchasing a ticket. The second preliminary question was whether the fact that the AVG provides for the possibility of objection affects the assessment of the legitimate interest basis. This proved not to be the case according to the Court. The legitimate interest must be independently present in a general sense and the fact that individuals have a possibility to object does not change that.

    Effects of the ruling

    This ruling has far-reaching implications for companies and organizations within the EU that collect personal data through online forms. It highlights the need to look critically at what data is collected and whether it is truly necessary for the provision of services. Companies must realize that any form of data collection that is not strictly necessary can be considered a violation of the AVG. It is conceivable that depending on the service, processing gender as personal data may be necessary, but this will have to be specifically considered first. The Court mentions that there are polite alternatives for addressing customers other than Mr. or Mrs.. One option, of course, is to choose "best first name", or, like the Dutch NS, for "dear traveler". However, there will also be people who do like to be approached with a more formal form of address. To achieve this option, the boxes address title in a registration form will usually have to be optional. However, the ruling seems to imply that the use of "Mr. or Mrs." will only continue to be possible if valid consent has been given. This will require careful construction of such a form.
    AKD

    Share article

    Comments

    MORE REACTIONS

    Leave a comment

    You must be logged in to post a comment.

    NEWS

    Space to train and use AI models with personal data without consent under AVG

    Blog

    Do you like to play alone? Ubisoft is still watching you!

    blog

    EDPB opinion on responsible AI models and privacy rules

    News press release

    EDPB reports with critical note on EU-US Data Privacy Framework

    Blog

    The European Data Protection Supervisor (EDPB) published its first report on the EU-US Data Privacy Framework (DPF) on Nov. 20, 2024. This report assesses how...

    AP acts on privacy practices of credit reporting agencies Experian, Focum and EDR

    News press release
    Christian Cordoba Lenis

    Ads: Meta wants to be 'less illegal' - but much more annoying

    News press release

    Dear LinkedIn, new to your network: the AVG

    Blog

    Schrems v. Meta: Grip on sensitive data and flawed bases

    Articles

    European privacy regulators adopt new guidelines on legitimate interest

    News press release
    Information Security Netherlands

    E-course DPIA

    Upon completion of the e-learning DPIA, you will have a complete understanding of the theoretical and legal framework of DPIAs. All aspects are covered, including: when a DPIA is mandatory, what the substantive requirements are, and what standards and regulations apply to DPIAs. You will also be explained practical DPIA models.

    Learn more

    DPIA e-course and DPIA practice day

    With this course package, you will soon be conducting a DPIA within your organization. Get a complete theoretical and legal picture of DPIAs during the e-learning DPIA. During the DPIA practice day, we will practice performing DPIAs.

    Learn more

    DPIA practice day

    Work with course instructors through the entire DPIA process and cover various practical DPIA models. Thus,DPIA becomespart of privacy risk management.

    Learn more

    Privacy laws in detection

    You will be informed about legislation that applies to data processing by BOAs. You will learn when your BOAs must comply with the Wpg, when with the AVG and what the main differences are. You will also learn what steps need to be taken to comply with the Wpg.

    Learn more

    Join PONT | Data & Privacy

  • Access to Knowledge Base
  • Read e-books
  • Contact with peers
  • Own news overview
    • BECOME A MEMBER

    General

    Service

    Navigate

    Berghauser Pont Media Group

    CONTACT

    𝕏

    Copyright 2025 Berghauser Pont | Website created by Buro Zero