Kamu kaydındaki cinsiyet kimliği verisinin düzeltilmesi

–

VP, by G. Győző, ügyvéd, E. Polgári, and T.L. Sepsi, ügyvéd,

–

the Hungarian Government, by M.Z. Fehér and R. Kissné Berta, acting as Agents,

–

the Estonian Government, by N. Grünberg, acting as Agent,

–

the Spanish Government, by S. Núñez Silva and A. Pérez-Zurita Gutiérrez, acting as Agents,

–

the French Government, by R. Bénard, B. Dourthe and B. Fodda, acting as Agents,

–

the Netherlands Government, by M.K. Bulterman, A. Hanje and J.M. Hoogveld, acting as Agents,

–

the Portuguese Government, by P. Barros da Costa, A. Pimenta, J. Ramos and Â. Seiça Neves, acting as Agents,

–

the European Commission, by A. Bouchagiar, H. Kranenborg and Zs. Teleki, acting as Agents,

1

This request for a preliminary ruling concerns the interpretation of Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).

2

The request has been made in proceedings between VP, a natural person, and the Országos Idegenrendészeti Főigazgatóság (National Directorate-General for Immigration Policing, Hungary; ‘the asylum authority’) concerning the rectification of data, relating to VP’s gender identity, in a public register kept by that authority.

3

Recitals 1, 10, 59 and 73 of the GDPR state:

…

…

…

4

Article 1 of the GDPR, entitled ‘Subject matter and objectives’, provides, in paragraph 2:

‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’

5

Article 2 of the GDPR, entitled ‘Material scope’, provides, in paragraph 1:

‘This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.’

6

According to Article 4 of the GDPR, entitled ‘Definitions’:

‘For the purposes of this Regulation:

…’

7

Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides, in paragraph 1:

‘Personal data shall be:

…

…’

8

Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:

‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:

…

…

…

2.   Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

3.   The basis for the processing referred to in [points] (c) and (e) of paragraph 1 shall be laid down by:

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

…’

9

Article 16 of the GDPR, entitled ‘Right to rectification’, provides:

‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’

10

Article 23 of the GDPR, entitled ‘Restrictions’, provides, in paragraph 1:

‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

…

…’

11

Paragraph 81 of the a menedékjogról szóló 2007. évi LXXX. törvény (Law No LXXX of 2007 on the right to asylum) of 29 June 2007 (Magyar Közlöny 2007/83; ‘the Law on the right to asylum’) provides:

‘The competent authority in asylum matters shall, in the register relating to such matters, process the personal data of refugees, beneficiaries of subsidiary protection, beneficiaries of resettlement schemes, beneficiaries of temporary protection, and also persons seeking international protection and persons subject to the Dublin procedure (together, “persons subject to this law”), information relating to their stay and to the assistance and aid to which they are entitled, as well as subsequent changes to such information, for the purpose of:

12

Paragraph 82 of the Law on the right to asylum provides:

‘For the purposes of this chapter, the following data of the persons subject to this law shall be regarded as identification data of natural persons:

…

(f) gender.’

13

Under Paragraph 83(1) of that law:

‘The register for asylum matters shall contain the following data of the persons subject to this law:

…’

14

Paragraph 83/A(5) of that law provides:

‘The competent authority in asylum matters shall be obliged, of its own motion, to delete entries which are contrary to the regulations, to correct those which are incorrect and to supply any entries omitted from the official register kept by it.’

15

VP is an Iranian national who obtained refugee status in Hungary in 2014. In support of their application for that status, VP relied on their transgender identity and produced medical certificates drawn up by specialists in psychiatry and gynaecology. According to those certificates, although VP was born female, their gender identity was male. Following recognition of VP’s refugee status on that basis, VP was nevertheless registered as female in the asylum register which, in accordance with the provisions of the Law on the right to asylum, is kept by the asylum authority and contains identification data, including gender, of the natural persons who have obtained that status.

16

In 2022, VP submitted a request to the asylum authority, on the basis of Article 16 of the GDPR, to have the entry in respect of their gender rectified in order to indicate that VP is male and to have their forename amended in the asylum register. VP annexed the abovementioned medical certificates to that request. By decision of 11 October 2022, that authority rejected that request on the ground that (i) VP had not proved that they had undergone gender reassignment surgery, and (ii) the certificates provided established only VP’s transgender identity.

17

VP brought an action for annulment of that decision before the Fővárosi Törvényszék (Budapest High Court, Hungary), which is the referring court. In support of VP’s action, VP submits that transgender identity implies, by definition, a change of gender identity and that the medical certificates submitted confirm that change. VP argues that it is apparent from the case-law of the European Court of Human Rights that gender reassignment surgery cannot be required for the purposes of recognising a change of gender identity. Such a requirement is also contrary, in particular, to Articles 3 and 7 of the Charter. VP further submits that several Member States, including the Kingdom of Belgium, the Kingdom of Denmark, Ireland, the Hellenic Republic, the Republic of Malta, the Portuguese Republic and the Kingdom of Sweden, recognise changes in gender identity on the basis of declarations made by the persons concerned. VP states that the medical certificates submitted in support of VP’s action refer to VP’s male appearance and expressly refer, by way of diagnosis, to Code F64.0 of the International Classification of Diseases established by the World Health Organization (WHO), relating to transgender identity.

18

The asylum authority contends that the action should be dismissed.

19

According to the referring court, while it is true that the Law on the right to asylum contains a general provision regarding the rectification of incorrect entries, that law does not lay down either the procedure or the conditions for recognition of a change of gender identity and/or forename in connection with such a change. In that regard, the Alkotmánybíróság (Constitutional Court, Hungary) held, in its judgment No 6/2018 of 27 June 2018, that the failure of the Hungarian legislature to adopt a procedure allowing persons who are lawfully resident in Hungary, without being Hungarian nationals, to amend the entry relating to their gender and forename, even though such a possibility was available to Hungarian nationals, was unconstitutional. In addition, the European Court of Human Rights held, by its judgment of 16 July 2020, Rana v. Hungary (CE:ECHR:2020:0716JUD004088817), that Hungary had violated the ECHR by not providing for a procedure for the legal recognition of a change of gender identity for refugees. That legal vacuum has persisted since then, despite those judgments.

20

That situation is allegedly aggravated by the fact that, since 2020, the possibility of legal recognition of a change in gender identity has ceased to exist for Hungarian nationals. It is precisely because of that lack of possibility of recognition under national law that VP brought their action on the basis of Article 16 of the GDPR. In such a context, the referring court asks whether that article places on the asylum authority an obligation to rectify gender data in the asylum register and, if so, what evidence the data subject would have to provide in support of their request.

21

In those circumstances, the Fővárosi Törvényszék (Budapest High Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

22

By its first question, the referring court asks, in essence, whether Article 16 of the GDPR must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of Article 5(1)(d) of that regulation.

23

As a preliminary point, it should be noted that, under Article 16 of the GDPR, the data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

24

That provision gives specific expression to the fundamental right enshrined in the second sentence of Article 8(2) of the Charter, according to which everyone has the right of access to data which have been collected concerning him or her, and the right to have them rectified.

25

In addition, Article 16 of the GDPR must be read in the light, first, of Article 5(1)(d) of the GDPR, which enshrines the principle of accuracy, under which processed data must be accurate and, where necessary, kept up to date, and that every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay. Second, that provision must also be read in the light of recital 59 of the GDPR, from which it is apparent that modalities should be provided for facilitating the exercise of the data subject’s rights under that regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, rectification of personal data.

26

In that regard, it must be noted that, according to the case-law of the Court, the assessment of whether personal data is accurate and complete must be made in the light of the purpose for which those data were collected (see, by analogy, judgment of 20 December 2017, Nowak, C‑434/16, EU:C:2017:994, paragraph 53).

27

Lastly, for the purposes of interpreting Article 16 of the GDPR, it should also be noted that the objective pursued by that regulation, as is set out in Article 1 thereof and in recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU (judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 21 and the case-law cited).

28

In accordance with that objective, any processing of personal data must, inter alia, comply with the principles relating to the processing of such data set out in Article 5 of the GDPR, including the principle of accuracy recalled in paragraph 25 of the present judgment, but also satisfy the lawfulness conditions listed in Article 6 of that regulation (see, to that effect, judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 22 and the case-law cited).

29

In those circumstances, keeping the processed data up to date constitutes an essential aspect of the protection of the data subject with regard to the processing of those data.

30

In the present case, it is common ground, first, that the information relating to VP’s gender identity may be classified as ‘personal data’, since it relates to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR, and, second, that those data were the subject of ‘processing’, within the meaning of Article 4(2) of that regulation, since they were collected and registered by the asylum authority in a public register, namely the asylum register. Consequently, such processing, which relates to data contained or intended to form part of a filing system, falls within the material scope of that regulation, pursuant to Article 2(1) thereof (see, by analogy, judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 30).

31

Although compliance with the conditions governing the lawfulness of the processing concerned, within the meaning of Article 6 of the GDPR, does not appear to have been called into question in the context of the dispute in the main proceedings, the asylum authority’s compliance with the principle of accuracy set out in Article 5(1)(d) of that regulation is disputed by VP, who seeks rectification of the personal data relating to their gender identity, under Article 16 of that regulation.

32

In the light of the case-law referred to in paragraph 26 of the present judgment, it is for the referring court to verify the accuracy of the data at issue in the main proceedings in the light of the purpose for which they were collected and to assess, in particular, in the light of Article 81(c) of the Law on the right to asylum, whether the purpose of collecting those data is to identify the data subject. If that were the case, those data would therefore appear to refer to that person’s lived gender identity, and not to the identity assigned to them at birth. In such a context, contrary to what the Hungarian Government maintains, it is for the controller, in the present case the asylum authority, to take into consideration that person’s gender identity at the time of their registration in the asylum register, and not the gender identity assigned to them at birth.

33

Consequently, as the Advocate General observed, in essence, in points 31 and 40 of his Opinion, and in the light of the file before the Court, according to which, in the context of the procedure for granting refugee status, Hungary accepted that VP was a transgender person, the personal data relating to their gender identity, which is set out in the asylum register, appear to have been incorrect from the time of those data being recorded.

34

In that regard, contrary to what the Hungarian Government maintains, a Member State cannot rely on specific provisions of national law, adopted on the basis of Article 6(2) and (3) of the GDPR, in order to limit the right to rectification enshrined in Article 8(2) of the Charter and given specific expression in Article 16 of the GDPR.

35

First, it is apparent from the third sentence of recital 10 of that regulation that those specific provisions are intended only to further specify the application of the rules contained in the GDPR, and not to derogate from them.

36

Second, the right to rectification set out in Article 16 of the GDPR may be restricted only in accordance with the conditions set out in Article 23 of that regulation, read in the light of recital 73 thereof. Thus, a Member State may in particular lay down, by internal legislative measures, restrictions on that right, in respect of personal data set out in public registers kept for reasons of general public interest. However, in the present case, as the Advocate General observed, in essence, in point 44 of his Opinion, it is not apparent from the file before the Court that the Hungarian legislature restricted, whilst complying with the conditions set out in Article 23 of the GDPR, the scope of that right to rectification, or that the asylum authority justified its refusal of the requested rectification by relying on such a statutory restriction. Subject to verification by the referring court, it would appear that that refusal is not based on a legislative measure adopted under Article 23 of the GDPR, but on the finding that VP had not provided proof of their gender identity.

37

In any event, a Member State cannot rely on the absence, in its national law, of a procedure for the legal recognition of transgender identity in order to limit the right to rectification. In that regard, it should be noted that, although EU law does not detract from the Member States’ competence in the area of the civil status of persons and the legal recognition of their gender identity, those States must, however, in exercising that competence, comply with EU law. Thus, national legislation which prevents a transgender person, in the absence of recognition of their gender identity, from fulfilling a requirement which must be met in order to be entitled to a right protected by EU law such as, in the present case, the right enshrined in Article 8(2) of the Charter and given specific expression in Article 16 of the GDPR, must be regarded as being, in principle, incompatible with EU law (see, by analogy, judgment of 4 October 2024, Mirin, C‑4/23, EU:C:2024:845, paragraphs 53 and 60 and the case-law cited).

38

In the light of all the foregoing considerations, the answer to the first question is that Article 16 of the GDPR must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of Article 5(1)(d) of that regulation.

39

By its second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 16 of the GDPR must be interpreted as meaning that a Member State may, by means of an administrative practice, make the exercise of the right to rectification of the personal data relating to the gender identity of a natural person, which are contained in a public register, conditional upon the production of evidence of, in particular, gender reassignment surgery.

40

As the Advocate General observed in point 47 of his Opinion, Article 16 of the GDPR does not specify which evidence may be required by a controller in order to establish the inaccuracy of the personal data which a natural person seeks to have rectified.

41

In that context, although the data subject, requesting the rectification of those data, may be required to provide relevant and sufficient evidence which, in the light of the circumstances of the particular case, can reasonably be required of that person in order to establish that those data are inaccurate (see, by analogy, judgment of 8 December 2022, Google (De-referencing of allegedly inaccurate content), C‑460/20, EU:C:2022:962, paragraphs 68 and 72), it must, however, be stated, as recalled in paragraph 36 of the present judgment, that a Member State may restrict the exercise of the right to rectification only in compliance with Article 23 of the GDPR.

42

Article 23(1) of the GDPR provides that EU or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34 of that regulation, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 of that regulation, provided, however, that such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society in order to safeguard certain objectives listed in that regulation, such as, inter alia, important objectives of general public interest of the European Union or of a Member State. As stated in paragraph 36 of the present judgment, the right to rectification may be subject to restrictions in the context of the keeping of public registers that are kept for reasons of general public interest, in particular in order to ensure the reliability and consistency of those registers.

43

In the present case, it is apparent from the request for a preliminary ruling that the Member State concerned has adopted an administrative practice whereby the exercise, by a transgender person, of their right to rectification of data relating to their gender identity, contained in a public register, is conditional upon the production of evidence of gender reassignment surgery. Such an administrative practice gives rise to a restriction of the right to rectification, which must comply with the conditions referred to in Article 23 of the GDPR, as stated in the preceding two paragraphs of the present judgment.

44

First, it must be noted that that administrative practice does not satisfy the requirement that a Member State’s law may restrict the scope of the right provided for in Article 16 of the GDPR only by means of legislative measures. Subject to verification by the referring court, Hungarian law does not appear to contain any legislative measure relating to the evidential requirements applicable to the rectification of data relating to the gender identity of persons who are listed in the asylum register.

45

Second, such an administrative practice undermines the essence of the fundamental rights guaranteed by the Charter and, in particular, the essence of the right to the integrity of the person and the right to respect for private life, referred to in Articles 3 and 7 of the Charter respectively.

46

In that regard, it should be noted that, in accordance with Article 52(3) of the Charter, the rights guaranteed by the Charter have the same meaning and the same scope as the corresponding rights guaranteed by the ECHR, the latter constituting a minimum threshold of protection (see, to that effect, judgment of 4 October 2024, Mirin, C‑4/23, EU:C:2024:845, paragraph 63 and the case-law cited).

47

It is apparent from the settled case-law of the European Court of Human Rights that Article 8 ECHR, which corresponds to Article 7 of the Charter, protects a person’s gender identity, which is a constituent element and one of the most intimate aspects of their private life. Thus, that provision encompasses the right to establish details of their identity as individual human beings, which includes the right of transgender people to personal development and physical and moral integrity and to respect for and recognition of their gender identity. To that end, Article 8 imposes positive obligations on States, in addition to negative obligations to protect transgender persons against arbitrary interference by public authorities, which also entails the establishment of effective and accessible procedures guaranteeing effective respect for their right to gender identity. Furthermore, in view of the particular importance of that right, States have only limited discretion in this area (see, to that effect, judgment of 4 October 2024, Mirin, C‑4/23, EU:C:2024:845, paragraphs 64 and 65 and the case-law cited).

48

In that context, the European Court of Human Rights has held, inter alia, that the recognition of the gender identity of a transgender person cannot be made conditional on the completion of surgical treatment not desired by that person (see, to that effect, ECtHR, 19 January 2021, X and Y v. Romania, CE:ECHR:2021:0119JUD000214516, §§ 165 and 167 and the case-law cited).

49

Third and lastly, an administrative practice such as that at issue in the main proceedings is not, in any event, either necessary or proportionate in order to ensure the reliability and consistency of a public register, such as the asylum register, since a medical certificate, including a psychiatric diagnosis, may constitute relevant and sufficient evidence in that regard (see, to that effect, ECtHR, 6 April 2017, A.P., Garçon and Nicot v. France, CE:ECHR:2017:0406JUD007988512, §§ 139 and 142).

50

In the light of the foregoing considerations, the answer to the second and third questions is that Article 16 of the GDPR must be interpreted as meaning that, for the purposes of exercising the right to rectification of the personal data relating to the gender identity of a natural person that are contained in a public register, that person may be required to provide relevant and sufficient evidence that may reasonably be required of that person in order to establish that those data are inaccurate. However, a Member State may not, under any circumstances, by way of an administrative practice, make the exercise of that right conditional upon the production of evidence of gender reassignment surgery.

51

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (First Chamber) hereby rules: