[Deldits] The name given to the present case is fictitious and does not correspond to the name of any party to the proceedings. VP v Országos Idegenrendészeti Főigazgatóság

1.

May Article 16 of the General Data Protection Regulation ( 2 ) – on the right to rectification – read in the light of Article 5(1)(d) thereof – on the principle of accuracy – require the body that maintains a national register of refugees to rectify personal data it recorded of a person’s gender? If it is so required, what evidence can it demand of a person who applies to rectify that record? The Fővárosi Törvényszék (Budapest High Court, Hungary) seeks answers to these questions.

2.

Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, states:

‘1.   Personal data shall be:

…

…’

3.

Under Article 16 of the GDPR, entitled ‘Right to rectification’:

‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’

4.

Article 23 of the GDPR, headed ‘Restrictions’, provides:

‘1.   Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

…’

5.

Paragraph 81 of the menedékjogról szóló 2007. évi LXXX. törvény (Law LXXX of 2007 on the right to asylum) (‘the Asylum law’) ( 3 ) is in the terms following:

‘The competent authority in asylum matters shall, in the register relating to such matters, process the personal data of refugees, beneficiaries of subsidiary protection, beneficiaries of resettlement schemes, beneficiaries of temporary protection, and also persons seeking international protection and persons subject to the Dublin procedure (together, “persons subject to this law”), information relating to their stay and to the assistance and aid to which they are entitled, as well as subsequent changes to such information, for the purpose of:

6.

Paragraph 82(f) of that law provides:

‘For the purposes of this chapter, the following data of the persons subject to this law shall be regarded as identification data of natural persons:

…

(f) [sex/gender].’

7.

Under Paragraph 83(1)(a) of that law:

‘The register for asylum matters shall contain the following data of the persons subject to this law:

…’

8.

Paragraph 83A(5) of the Asylum law provides that:

‘The competent authority in asylum matters shall be obliged, of its own motion, to delete entries which are contrary to the regulations, to correct those which are incorrect and to supply any entries omitted from the official register kept by it.’

9.

In 2014, the competent authority in Hungary granted V.P. (‘the applicant’) ( 4 ) – an Iranian national who was ‘born a woman’ – refugee status. In the procedure which led to that decision, the applicant relied on their transsexuality as the ground for their recognition as a refugee and tendered certificates from specialists in psychiatry and gynaecology by way of proof. Upon recognition of their refugee status, the Országos Idegenrendészeti Főigazgatóság (National Directorate-General for Immigration Policing; Hungary, ‘the defendant’) recorded personal data, including gender, in the asylum register that it maintained in order to facilitate the applicant’s identification. The record states that the applicant is female.

10.

In 2022, the applicant, pursuant to Article 16 of the GDPR, submitted a request to the defendant to rectify the asylum register in two particulars: a change of the name under which they had been registered and a change of gender from female to male. In support of that request, the applicant furnished the same medical evidence that they had submitted in the asylum procedure. By decision of 11 October 2022 (‘the decision’), the defendant rejected that request. It stated that the documents provided merely confirmed that the applicant was transgender. The documents did not prove that they had undergone gender reassignment surgery and that the applicant’s gender had changed.

11.

The applicant brought proceedings before the referring court for the annulment of the decision. At all material times, the applicant has identified as male. They claimed that, from a conceptual viewpoint, transsexuality involves a change of gender. The medical reports submitted confirm that the applicant has a male appearance and that they were diagnosed under code F64.0 of the International Classification of Diseases, which reference corresponds to transsexualism. Relying on the case-law of the ECtHR ( 5 ), the applicant submitted that surgery is unnecessary for gender reassignment. The rectification procedure under Article 16 of the GDPR does not require a person to produce ‘excessive evidence’, in particular, certification that they have undergone surgery for the purposes of gender reassignment. In any event, that requirement is contrary to the case-law of the ECtHR. It also violates Article 1 (right to human dignity), Article 3 (right to the integrity of the person), Article 7 (right to respect for private and family life) and Article 52(3) (principle of equivalent protection of fundamental rights) of the Charter of Fundamental Rights of the European Union (‘the Charter’). The applicant also drew attention to the fact that a number of Member States ( 6 ) recognise a declaration by a transgender person as legal proof of their gender identity.

12.

The defendant claims that the action should be dismissed. It submits that the applicant has provided neither public document nor medical evidence to certify an asserted change of gender.

13.

The referring court considers that an interpretation of Article 16 of the GDPR is necessary to clarify the conditions under which a data subject may seek to rectify data recorded in respect of their gender. While the Asylum law envisages processing alterations to recorded data and the correction of erroneous entries, it regulates neither the procedure nor the requirements whereby a change of gender or a consequent name change may be recorded.

14.

In its judgment of 27 June 2018, the Alkotmánybíróság (Constitutional Court, Hungary) ( 7 ) declared that the failure of the Hungarian legislature to adopt a procedure to enable lawfully settled non-Hungarian citizens to change their gender and their name, while affording Hungarian citizens that possibility, was unconstitutional as an infringement of Article II (inviolability of human dignity) and Article XV(2) (prohibition of discrimination) of the Magyarország Alaptörvény (Fundamental Law of Hungary). The Alkotmánybíróság (Constitutional Court) called upon the Hungarian Parliament to remedy that default by 31 December 2018 at the latest. In its judgment of 16 July 2020, Rana v. Hungary, ( 8 ) the ECtHR declared that Hungary had violated Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, (‘the ECHR’) by failing to grant a refugee access to a procedure to facilitate legal recognition of a change of gender.

15.

The Fővárosi Törvényszék (Budapest High Court) recalls that, notwithstanding the judgments of the Alkotmánybíróság (Constitutional Court) and of the ECtHR, Hungarian legislation does not make a procedure for the legal recognition of a change of gender available to persons who are lawfully resident in Hungary but who do not have the nationality of that Member State. In the wake of the judgment of the Alkotmánybíróság (Constitutional Court), Hungary no longer affords legal recognition to a citizen’s change of gender. The referring court is accordingly of the view that it is unable to ‘fill the gap in the law by means of the analogous application of the provisions relating to Hungarian citizens.’

16.

The Fővárosi Törvényszék (Budapest High Court) thus decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

17.

The applicant, the Estonian, Spanish, French, Hungarian, Netherlands and Portuguese Governments and the European Commission submitted written observations.

18.

The applicant’s written observations indicated that they had acquired Hungarian citizenship ‘in the meantime’ and that their enrolment in the asylum register was no longer required. Pursuant to Article 101(1) of the Rules of Procedure of the Court of Justice, the Court asked the referring court to clarify the impact of that change of circumstances upon the main proceedings. The referring court replied that it had no impact on the outcome of those proceedings since, pursuant to Article 85(2) of the közigazgatási perrendtartásról szóló 2017. évi I. törvény (Law No I of 2017 establishing the Code of Administrative Procedure), ( 9 ) that court ‘shall review the lawfulness of the administrative activity in accordance with the facts prevailing at the time of its implementation’.

19.

The applicant, the Spanish, French, Hungarian, and Netherlands Governments and the Commission presented oral argument and replied to the Court’s questions at the hearing on 3 June 2024.

20.

The applicant contends that, pursuant to Article 5(1)(d) of the GDPR, the accuracy of data must be assessed having regard to the purposes for which they are processed. The purpose of the asylum register is to identify those persons whom Hungary recognises as refugees. Where the gender of a transgender person as recorded does not reflect the identity by which they are recognised in public, as opposed to their legal identity, that record does not facilitate their identification and may even expose them to discrimination and harassment. Article 16 of the GDPR must be so interpreted as to facilitate rectification of data on the gender of transgender persons.

21.

By reference to Article 5(1)(d), Article 6(2) and Article 16 of the GDPR, the Estonian Government contends that Member States must introduce national procedural rules that enable a person, who has experienced gender reassignment, to seek rectification of personal data in a public register that have become inaccurate in the light of the purposes for which they were processed.

22.

The Spanish Government submits that national legislation on the legal recognition of transgender identity, which imposes conditions on persons who seek to rectify personal data on their gender recorded in public registers, limits the exercise of the right of rectification contained in Article 16 of the GDPR. Although such limitations may be justified by the necessity to safeguard the interests to which Article 23 of the GDPR refers, Hungary may not rely upon that provision because it has not enacted legislation to recognise the gender of transgender persons. In any event, the various interests to which that provision refers do not apply in the circumstances of the case before the referring court.

23.

Since the applicant has refugee status, the Spanish Government further submits that provisions of EU law other than the GDPR are relevant to this reference for a preliminary ruling, such that the Court ought to reformulate the first question. Amongst the measures that the Court should interpret in this context are Articles 7 and 21 of the Charter and Article 24(1) ( 10 ) and Article 25(1) ( 11 ) of Directive 2011/95. ( 12 ) The Spanish Government pleads that those provisions preclude a national legal system that does not ‘provide for any procedure enabling a person with refugee status and having a transgender identity to change the reference to their gender in the asylum register.’ The absence of such a procedure also infringes the case-law of the ECtHR. ( 13 ) The Spanish Government relies, by analogy, on the Freitag judgment ( 14 ), which concerned a Member State’s refusal to recognise a name change made by another Member State. There the Court held that the confusion and inconvenience that arose from the divergence between the two names used in respect of the same person hindered the exercise of the right, enshrined in Article 21 TFEU, to move and reside freely in the territories of the Member States. According to the Spanish Government, a discrepancy between the female gender recorded on a residence permit or travel documents issued pursuant to Article 24(1) and Article 25(1) of Directive 2011/95 and the applicant’s identification as male – which the referring court found was consistent with their conduct and physical appearance – could give rise to confusion and doubt as to the applicant’s identity and the authenticity of those documents.

24.

The French Government makes a distinction between data that was inaccurate at the time that it was recorded and data that subsequently becomes inaccurate. It submits that, pursuant to Article 5(1)(d) and Article 16 of the GDPR, data relating to gender may be rectified with retroactive effect if it was inaccurate at the time it was recorded. In registers that record civil status, public authorities may have an interest in following the evolution of data on a person’s identity. Any procedure to facilitate such rectification may thus be designed so as to leave a trace of all data entered in those registers. ( 15 )

25.

The Hungarian Government considers that Article 16 of the GDPR, read in the light of Article 5(1)(d) of the GDPR and Article 8(2) of the Charter, confers a right on a person to rectify data on gender that does not correspond to reality. No difficulty would have arisen had the applicant sought to rectify data on their gender that had been registered incorrectly at the outset. Since, in the Hungarian Government’s view, the applicant seeks to rectify correctly recorded data, Article 16 of the GDPR does not apply. In support of that approach, that government draws an analogy with the Nowak judgment ( 16 ) in which the Court held that incorrect answers on an exam script are incapable of rectification.

26.

The Netherlands Government observes that the absence of an efficient procedure for the legal recognition of the change of a person’s gender constitutes a breach of Article 3 (Right to the integrity of the person) and Article 7 (Respect for private and family life) of the Charter. The absence of such a procedure is an obstacle to the applicant’s exercise of the right to rectify data on their gender pursuant to Article 16 of the GDPR.

27.

The Portuguese Government considers that Article 16 of the GDPR, interpreted in the light of Articles 1, 3, 7, 8 and 21 of the Charter, requires data subjects to be permitted to rectify data on their gender recorded for the purposes of their identification where that data has changed since its initial registration.

28.

The Commission submits that the first question is based on the premiss that the data in the asylum register on the applicant may be inaccurate. That assumption raises the issue as to whether the accuracy of data on a person’s gender is subject to the legal recognition of gender reassignment. In the light of Article 8 of the ECHR, Articles 7 and 8 of the Charter and the case-law of the ECtHR, ( 17 ) the Commission is of the view that the absence of a system for the recognition of gender reassignment may not impede rectification of inaccurate data on a person’s gender in a public register. In such circumstances, Article 16 of the GDPR, read in conjunction with Articles 7 and 8 and Article 52(1) of the Charter, requires that the authority responsible for keeping that record rectify personal data on the gender of the data subject once those data have become inaccurate.

29.

The first question from the Fővárosi Törvényszék (Budapest High Court) is based on the premiss that the data on the applicant’s gender in the asylum register were correctly recorded and that those data became inaccurate due to a change in circumstances since that record came into existence. The referring court thus asks whether Article 16 of the GDPR confers a right to rectify that personal data to reflect a change of gender by a transgender person.

30.

The Article 267 TFEU procedure is an instrument for cooperation between the Court of Justice and national courts, by means of which the former provides an interpretation of EU law that enables the latter to rule upon proceedings pending before them. In the context of that cooperation, the Court affords a presumption of relevance to questions from national courts that relate to EU law. The Court thus refuses to rule on such questions only where it is quite obvious that the interpretation of EU law sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer thereto. Since the Court’s jurisdiction in preliminary rulings is to assist in the administration of justice in the Member States and not to deliver advisory opinions on general or hypothetical questions, it may reformulate the questions referred to it. ( 18 )

31.

In this case, I discern a significant difference between the facts that the referring court describes in the order for reference and the text of the first question. These facts disclose that the applicant’s change of gender identity occurred prior to the recognition of their refugee status in 2014, such that that change of gender identity appears to have been the basis upon which Hungary recognised the applicant’s refugee status. ( 19 ) It further appears that there has been no evolution or change in the applicant’s gender since 2014. The record of the applicant’s gender in the asylum register was, accordingly, incorrect at the time it was entered therein. The case before the referring court is thus one where the data to be rectified was recorded incorrectly at the outset and not one where it became inaccurate ‘after’ ( 20 ) the creation of that record. The application before the referring court thus seeks to correct an original error and not to amend that record in order to reflect a change in circumstances.

32.

In order to avoid answering a hypothetical question that would take it outside of the jurisdiction that Article 267 TFEU confers upon it, I advise that the Court take account of the facts that underlie the order for reference when it delivers its response to the first question. ( 21 )

33.

Contrary to the Spanish Government’s observations, I consider that the questions from the Fővárosi Törvényszék (Budapest High Court) do not seek to ascertain whether EU law requires a Member State to establish a legal framework to facilitate recognition of a change of gender identity of a person whom it recognises as a refugee. The request for a preliminary ruling expressly inquires into the nature and scope of the right to rectify inaccurate data under Articles 5 and 16 of the GDPR. An interpretation of those provisions, in the light of the facts the referring court describes, is thus sufficient to enable it to determine the main proceedings. In that context, I observe that the Fővárosi Törvényszék (Budapest High Court) did not refer any question with respect to the application to rectify the applicant’s name in the asylum register, such that it seems that application was incidental to the application to change the record of their gender. The request for a preliminary ruling thus does not address the possible application of Article 16 of the GDPR in the context of an application to change the record of a name. ( 22 ) Nor do the present proceedings afford the Court an opportunity to interpret Article 24(1) and Article 25(1) of Directive 2011/95. The order of the Fővárosi Törvényszék (Budapest High Court) neither mentioned those provisions nor provided any details of residence permits or travel documents that may have been issued to the applicant in accordance therewith. ( 23 )

34.

It is apparent from Article 1(2) of the GDPR, read in conjunction with recitals 4 and 10 thereof, that the GDPR has, inter alia, the purpose to ensure a high level of protection of the fundamental rights and freedoms of natural persons with regard to the processing of their personal data within the European Union. The GDPR creates a legal framework in order to implement the requirements of Article 8 of the Charter on the protection of personal data in particular. It is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter. ( 24 )

35.

The GDPR has a very broad material scope. By its Article 2(1), the GDPR applies ‘to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’ without any distinction as to the identity of the person who carried out that processing. Subject to the exceptions laid down in Article 2(2) thereof, upon which the defendant does not appear to rely, the GDPR applies to processing operations carried out by private persons and by public authorities. ( 25 )

36.

The definition of ‘personal data’ in point 1 of Article 4 of the GDPR does not refer to a natural person’s ‘sex’ or ‘gender’ as a factor that may, directly or indirectly, identify a natural person. The expression ‘any information’ in the definition of ‘personal data’ in that provision nonetheless gives that concept a broad scope. ( 26 ) The reference to ‘factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’ appears to be sufficiently wide as to encompass a natural person’s gender. ( 27 ) It follows that the registration of the applicant’s personal data, including gender, in a public register of persons recognised as having refugee status, constitutes the ‘processing’ of personal data for the purposes of point 2 of Article 4 of the GDPR.

37.

Under Article 5(1)(a), (b), (c) and (d) of the GDPR, personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject; be collected for specified, explicit and legitimate purposes; be adequate, relevant and not excessive in relation to those purposes; and be accurate and, where necessary, kept up to date. ( 28 ) By Article 5(1)(d) of the GDPR, the processing of personal data ‘shall’ be accurate. Every reasonable step must be taken to ensure that personal data that are inaccurate having regard to the purposes for which they are processed are erased or rectified without delay.

38.

Article 6(1) of the GDPR sets out an exhaustive list of the cases where the processing of personal data is lawful. ( 29 ) Processing of personal data in an asylum register is, in principle, lawful by virtue of point (e) of the first subparagraph of Article 6(1) of the GDPR. In accordance with Article 6(2) of the GDPR, Member States may maintain or adopt specific provisions to adapt the application of that regulation’s rules to processing under point (e) of the first subparagraph of Article 6(1) to ensure that such processing is lawful and fair. By Article 6(3) of the GDPR, processing pursuant to point (e) of the first subparagraph of Article 6(1) must be based on EU law or on the law of a Member State to which the controller is subject. That legal basis must also be in the public interest and proportionate to the legitimate aim that it pursues. ( 30 ) Nothing in the file before the Court suggests that the entry and maintenance of a record of a refugee’s gender in the asylum register in Hungary does not comply with Article 6 of the GDPR. ( 31 )

39.

Article 8(2) of the Charter provides, inter alia, that ‘everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified’. Article 16 of the GDPR reflects that right. ( 32 ) The right of rectification and its enforcement at the initiative of private individuals ( 33 ) assist in effecting compliance with the principle of accuracy laid down in Article 5(1)(d) of the GDPR.

40.

Since the accuracy of personal data may vary depending on the context in which it is processed, the purpose of the collection of data has a direct bearing upon an assessment of its accuracy. ( 34 ) One of the enumerated purposes of the asylum register in Hungary is to identify a person ( 35 ) and ‘gender’ is deemed as ‘data which identifies a physical person’. ( 36 ) In 2014, when Hungary recognised the applicant’s refugee status, they identified as a transgender male. The competent Hungarian authorities accepted the evidence the applicant submitted in support of that gender identity. The entry of the applicant’s gender as ‘female’ in the asylum register thus appears to have been inaccurate for the purposes of Article 5(1)(d) of the GDPR.

41.

As a matter of first principle, such a record must be capable of rectification by virtue of Article 16 of the GDPR, read in the light of Article 5(1)(d) thereof. ( 37 ) Whatever considerations may arise as regards the application of those provisions to the rectification of a record that was correct at the time it was created (which raises the issue of the extent of the duty the GDPR places on data controllers to keep data updated and to process it dynamically), if those provisions did not give data subjects a right to have rectified a record that was demonstrably inaccurate at the time it was created, they would appear to serve no purpose.

42.

The Hungarian Government nevertheless submits that, according to Article 6(2) and (3) of the GDPR, the data subject’s right to have an entry in an official record, such as the asylum register, rectified may be exercised under the law of a Member State only and not by direct reliance upon Article 16 of the GDPR.

43.

While the combined provisions of point (e) of the first subparagraph of Article 6(1), and Article 6(2) and (3) of the GDPR grant Member States a ‘margin of manoeuvre’ ( 38 ) so as to allow them to maintain or to introduce more specific provisions in order to ‘adapt’ ( 39 ) the rules of the GDPR on the basis of which controllers may lawfully process personal data in the performance of a task carried out in the public interest or in the exercise of official authority, ( 40 ) contrary to the Hungarian Government’s submissions, Article 16 of the GDPR makes it clear that the lawful processing of data under point (e) of the first subparagraph of Article 6(1) thereof is subject to the right to rectification. Unlike other provisions of the GDPR on the rights of data subjects, Article 16 of the GDPR does not specify the manner in which the right of rectification is to be exercised in the light of certain provisions of Article 6 thereof. ( 41 ) In any event, Member States’ powers to maintain or to introduce such provisions may not derogate from the right to rectification enshrined in Article 8(2) of the Charter. That Member States may establish a legal framework to ensure the practical application of the right to rectification pursuant to Article 16 of the GDPR in respect, inter alia, of public registers kept for reasons of general public interest in accordance with point (e) of the first subparagraph of Article 6(1) thereof, cannot in any way limit access to, or the enjoyment of, the right to rectification. ( 42 )

44.

It is nevertheless the case that the right to rectification, read in the light of the principle of accuracy in Article 5(1)(d) of the GDPR, is not absolute and its exercise may be limited under certain conditions. ( 43 ) Article 23 of the GDPR lists a number of circumstances in which that right, amongst others that data subjects enjoy, may be restricted. The request for a preliminary ruling does not refer to that provision, nor does the Hungarian Government rely on it in its written submissions with a view to delimiting the application of Article 16 of the GDPR in the circumstances that give rise to this reference. Article 23(1)(e) ( 44 ) and recital 73 of the GDPR provide, inter alia, that Union or Member State law to which the data controller or processor is subject may restrict the scope of the obligations and rights for which Articles 5 and 16 thereof provide ‘to safeguard … other important objectives of general public interest of the Union or of a Member State’, such as the ‘keeping of public registers kept for reasons of general public interest’. ( 45 ) Such a restriction must be contained in a legislative measure, respect the essence of the fundamental rights and freedoms and constitute a necessary and proportionate measure in a democratic society. ( 46 ) A Member State may thus rely on Article 23(1)(e) of the GDPR to restrict the right to rectification in certain circumstances in order to ensure the reliability and consistency of public records, including records of civil status. ( 47 ) That of itself cannot be an obstacle to granting an application to rectify the applicant’s gender in an asylum register so as to record their gender identity as it was at the time it was entered therein. To accede to an application of that nature only serves to enhance the reliability of that register and the accuracy of the data recorded therein. ( 48 )

45.

I therefore advise the Court that Article 16 of the GDPR, read in the light of Article 5(1)(d) thereof, is to be interpreted as meaning that a national authority responsible for keeping a register of refugees is, upon application, required to rectify personal data on the gender of a refugee which that authority had incorrectly recorded at the time they were entered in that register.

46.

The second and third questions inquire as to the evidence a person who seeks to rectify a record of his or her gender pursuant to Article 16 of the GDPR must submit in support of that request and whether that person may be required to furnish proof of having undergone gender reassignment surgery. These questions can be examined together.

47.

Article 16 of the GDPR does not specify what, if any, proof a data subject must submit to obtain ‘from the controller without undue delay the rectification of inaccurate personal data concerning him or her’. This reflects the reality that the (in)accuracy of data, and the need for their rectification, is to be assessed on a case-by-case basis, as a consequence of which the evidence that may be required for that purpose will vary. Given the broad definition of ‘controller’ in point 7 of Article 4 of the GDPR, which includes public authorities and natural persons, rules or modalities on the right to rectification may be contained in legislation ( 49 ) or decided on an ad hoc basis so as to address individual circumstances. It follows that a person who seeks rectification of data may be required to produce evidence that may be reasonably required to establish the inaccuracy of that data in the light of the purposes for which they were collected or processed. ( 50 ) It must be emphasised that the data subject does not have to claim or to demonstrate a particular interest in the rectification of inaccurate data or that the alleged inaccuracy causes any harm. In the present case, subject to verification by the referring court, I consider that it is sufficient that the applicant produce evidence to show that Hungary recognised their refugee status in 2014 on the basis of their pre-existing transgender identity and that the asylum register does not accurately record that identity. ( 51 )

48.

The GDPR does not impose any requirement that the applicant show that they have undergone gender reassignment surgery. The ECtHR has repeatedly condemned the imposition of such a requirement, holding that ‘making the recognition of transgender persons’ gender identity conditional on sterilisation surgery or treatment – or surgery or treatment very likely to result in sterilisation – which they do not wish to undergo therefore amounts to making the full exercise of their right to respect for their private life under Article 8 of the [ECHR] conditional on their relinquishing full exercise of their right to respect for their physical integrity as protected by that provision and also by Article 3 of the [ECHR].’ ( 52 ) In many instances, the imposition of such a requirement would have the effect of negating the right to rectify inaccurate data on the gender of a transgender person pursuant to Article 16 of the GDPR. ( 53 ) A requirement to produce such evidence would also, in my view, undermine human dignity which, in accordance with Article 1 of the Charter, is inviolable and must be respected and protected. Such a requirement is equally incompatible with Article 3(1) of the Charter, which states that ‘everyone has the right to respect for his or her physical and mental integrity’ and Article 7 of the Charter (respect for private and family life). In that context, I would add that national courts are bound to respect the rights recognised in the Charter when they apply the GDPR.

49.

In the light of the foregoing, I propose that the Court answer the questions referred by the Fővárosi Törvényszék (Budapest High Court, Hungary) as follows:

Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation), read in the light of Article 5(1)(d) thereof,

must be interpreted as meaning that a national authority responsible for keeping a register of refugees: