Does the GDPR require the use of gender-neutral language in contracts?

Does the GDPR mean gender-neutral language is required? Today’s Opinion by Advocate General Szpunar challenges a common practice in certain languages, namely asking for title (“Madame” & “Monsieur” in French) for contract-related communications. Many organisations want the opening line of an e-mail to be personalised in the name of customer service (“Cher Monsieur XX”, “Ch�re Madame YY”).

The Opinion is a really interesting read in many respects.

AG Szpunar first says that data minimisation applies to each legal ground, including consent (the underlying message: “consent […] does not mean general consent to the processing of all data”, raising interesting questions re the scope of consent).

1. Contract as legal ground

The AG recognises that communications can be objectively indispensable for a contract: “such communication [with the customer] should be considered to form an integral part of the transport contract” as it “entails the supply of a travel document and therefore being in contact with the customer for the purpose of sending the ticket to him or her” (for the duration of travel + even post-travel for certain exchanges). (�42)

But the AG questions necessity here: “the proper performance of the transport contract does not depend on the use of a title in the transport company�s communications with its customer, even where the controller intends to communicate with its customers in a personalised fashion. A transport company can easily communicate with its customers in a personalised fashion without using their title” (�47).

The controller had argued that this was also to preserve a brand image and show respect. Yet “subject to verification by the referring court” that controller did not “systematically employ, in practice, commonly accepted practices in commercial communications that require knowledge of the customer�s title”, as evidenced by more general expressions (e.g. “Hello”, “Thank you, enjoy your journey”). (�49)

2. Legitimate interests (LI)

On LI, AG Szpunar highlights two points:
– a mere reference to “legitimate interests” is insufficient, you have to specify which one (hello Art. 13(1)(d) GDPR)
– that should in AG Szpunar’s view not be merely specified in a privacy statement but be “brought directly to the customer�s attention when he or she provides the data in question relating to him or her” (�58). [Whether this means listing each LI in a 1st layer is another matter in my view.]

The AG then adds some broader considerations re title and LI, joining the complainant’s view that the processing of title might lead to discrimination on the ground of gender. The result? Likely LI cannot be relied upon.

What to make of it? Carefully document your legal grounds + data minimisation. Don’t rely on standard practices alone – make your own assessment.
(CJEU judgment soon)

Link: https://lnkd.in/ebJ-gqvE

GDPR data protection privacy