In one of the most recent judgments, in case C-394/23 Mousse v CNIL and SNCF Connect of 09 January 2025, the Court of Justice of the European Union addressed the question of whether it is in accordance with the General Data Protection Regulation (GDPR) to require customers to use the title “Mr” or “Ms” when purchasing travel tickets online. Even before the judgment itself was issued, it was clear that the judgment could have a fairly wide-ranging impact not only on the process of purchasing travel tickets online, but also on the purchase of any other goods and services on the internet.

The Court of Justice of the EU finally ruled that the above-mentioned processing of customers’ personal data, the purpose of which is to personalise commercial communications on the basis of their gender identity, does not appear to be objectively necessary or essential to enable the proper performance of the transport contract. The Court of Justice of the EU concluded that the conditions were not met in this case.

With this judgment, the Court of Justice of the EU emphasised the principle of data minimisation under the General Data Protection Regulation (GDPR), which requires that personal data processed be adequate, relevant and limited to what is necessary for the purpose in question. However, the Court of Justice of the EU also pointed out that the right to the protection of personal data must always be assessed in relation to its function in society and must be balanced against other fundamental rights, in accordance with the principle of proportionality.

The judgment in question does not mean that there is any general impossibility of processing such data. Such data can be processed on the basis of a legitimate interest, with the main condition being that the legitimate interest be communicated. The judgment has thus provoked mixed reactions among data protection experts, lawyers and, last but not least, the public. Many privacy advocates have welcomed it as a significant step towards strengthening individuals’ rights and underlining the principle of data minimisation under the General Data Protection Regulation (GDPR).

On the other hand, some online service providers and retailers have expressed concerns about the practical implications of this ruling. The use of titles such as “Mr.” or “Ms.” is often considered standard practice in customer communication and personalization of services, for example in email communications. However, the ruling suggests that such practices may be in violation of the General Data Protection Regulation (GDPR) if they are not strictly necessary for the provision of the service or if customers are not sufficiently informed about the purpose of such processing.