News

ECJ rules on gender identity rectification under GDPR

Can a person demand rectification of their gender entry in a registar?

 

a Member State cannot rely on the absence in its national law, of a procedure for the legal recognition of transgender identity in order to limit the right to rectification.

The European Court of Justice delivered last March its preliminary ruling concerning the interpretation of Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the GDPR). The case involved an Iranian national with refugee status who requested rectification of their gender identity data kept in a Hungarian public register.

Facts of the case

VP is an Iranian national who was given refugee status in Hungary in 2014. VP was born female but their gender identity according to medical certificates drawn up by specialists in psychiatry and gynaecology was male.  Hungary recognized VP’s refugee status registering him nevertheless as female in the asylum register. VP tried to rectify the gender entry in the register, submitting a request to the asylum authority and annexing the relevant medical certificates.  The Government rejected the request, effectively arguing that VP ought to have proven that they had undergone gender reassignment surgery. Budapest High Court decided to stay the proceedings and referred three questions to the Court of Justice for a preliminary ruling.

Legal questions raised

The first question was whether a national authority responsible for maintaining a public register is required to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate. In other words, was the Hungarian asylum authority obliged to amend its records so that VP would be identified as male?

The referring Court asked furthermore whether Article 16 of the GDPR must be interpreted as meaning that a Member State has the right to set specific conditions and in particular, demand evidence for gender reassignment surgery for the exercise of the right to rectification of the personal data relating to the gender identity of a natural person, which are contained in a public register.

The ECJ’s findings

The ECJ reaffirmed that Article 16 of the GDPR , following Article 8 (2) of the Charter, safeguards the data subject’s right to demand and obtain from the data controller without undue delay the rectification of inaccurate personal data concerning him or her. Furthermore, the ECJ held that the rectification clause of Article 16 must be read in the light of both Article 5 (1) (d) which enshrines the principle of accuracy and Article 59 which requires rectification mechanisms to be in place.  The ECJ concluded that keeping the processed data up to date constitutes an essential aspect of the protection of the data subject with regard to the processing of those data.

The decisive matter regarding the gender data was for the ECJ to identify the purpose for which the data in question were obtained and retained and in particular whether the purpose was to identify the data subject according to the local asylum legislation. If that were the case, those data would appear to refer to the person’s lived gender identity and not to the identity assigned to them at birth. Therefore, the asylum authority needed to take into consideration that person’s gender identity at the time of their registration in the asylum register and not the gender identity assigned to them at birth. Since Hungary accepted that VP was a transgender person, the personal data relating to their gender identity which was set out in the asylum register was incorrect.

In my opinion, the most important ECJ finding is that a Member State cannot rely on the absence in its national law, of a procedure for the legal recognition of transgender identity in order to limit the right to rectification.

In that regard, the ECJ noted that, although EU law does not detract from the Member States’ competence in the area of the civil status of persons and the legal recognition of their gender identity, those States must, however, in exercising that competence, comply with EU law. Thus, the conclusion of the ECJ was that national legislation which prevents a transgender person, in the absence of recognition of their gender identity, from fulfilling a requirement which must be met in order to be entitled to a right protected by EU law such as, in the present case, the right enshrined in Article 8(2) of the Charter and given specific expression in Article 16 of the GDPR, must be regarded as being, in principle, incompatible with EU law.

As to the other two questions posed by the referring Court, the ECJ held that national authorities may not require evidence for gender reassignment surgery in order to allow the exercise of the data subject’s right to rectification.

The ECJ held that although Article 16 of the GDPR does not specify which evidence may be required by a controller in order to establish the inaccuracy of the personal data which a natural person seeks to have rectified, a Member State may restrict the exercise of the right to rectification only in compliance with Article 23 of the GDPR. Article 23(1) of the GDPR provides that EU or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34 of that regulation, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 of that regulation, provided, however, that such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society in order to safeguard certain objectives listed in that regulation, such as, inter alia, important objectives of general public interest of the European Union or of a Member State.

Hungary had adopted an administrative practice whereby the exercise, by a transgender person, of their right to rectification of data relating to their gender identity, contained in a public register, was conditional upon the production of evidence of gender reassignment surgery. Such an administrative practice equals to a restriction of the right to rectification, which must comply with the conditions referred to in Article 23 of the GDPR.

The ECJ noted that that administrative practice is not in compliance with the requirement that a Member State’s law may restrict the scope of the right provided for in Article 16 of the GDPR only by means of legislative measures.

The ECJ held furthermore that such an administrative practice undermines the essence of the fundamental rights guaranteed by the Charter and, in particular, the essence of the right to the integrity of the person and the right to respect for private life, referred to in Articles 3 and 7 of the Charter respectively.

The ECJ stressed that Article 8 ECHR, which corresponds to Article 7 of the Charter, protects a person’s gender identity, which is a constituent element and one of the most intimate aspects of their private life. Thus, that provision encompasses the right to establish details of their identity as individual human beings, which includes the right of transgender people to personal development and physical and moral integrity and to respect for and recognition of their gender identity. To that end, Article 8 imposes positive obligations on States, in addition to negative obligations to protect transgender persons against arbitrary interference by public authorities, which also entails the establishment of effective and accessible procedures guaranteeing effective respect for their right to gender identity.  In that context, the European Court of Human Rights had held in the past, inter alia, that the recognition of the gender identity of a transgender person cannot be made conditional on the completion of surgical treatment not desired by that person.

 

Article provided by INPLP member: Alexia Kountouri (Tassos Papadopoulos & Associates LLC, Cyprus)

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)