Direct answer · GDPR
Data minimisation and necessity for a contract
Only if those data are really needed. Personal data must be adequate, relevant and limited to what is necessary (Article 5(1)(c)). The Court of Justice held in Mousse that a transport company may not require the form of address (Mr or Mrs) on the basis of the contract (Article 6(1)(b)), because it is not objectively indispensable for the transport. Legitimate interest (Article 6(1)(f)) is only possible if the customer has been informed of that interest, the processing is strictly necessary and the rights of the customer, such as the risk of discrimination based on gender identity, do not override it.
For you to establish
- What exactly does the organisation use the data for?
Articles
- Art. 5(1)(c) GDPR Data minimisation.
- Art. 6(1)(b) and (f) GDPR Necessity for the contract and legitimate interest.
Case law
- Mousse (CJEU, C-394/23, ECLI:EU:C:2025:2, 2025-01-09)Operative part: the form of address is not necessary for the transport contract; strictly necessary under legitimate interest.
Read the article Check your own case General interpretation, not legal advice. The official source remains authoritative.
