GDPR and transgender identity: the rectification of data relating to gender identity cannot be made conditional upon proof of surgery (CJEU)
In its Judgment in Case C-247/23 |[Deldits] [1] the European Court of Justice ruled that the rectification of data relating to gender identity cannot be made conditional upon proof of surgery.
In 2014, VP, an Iranian national, obtained refugee status in Hungary by relying on their transgender identity and producing medical certificates drawn up by specialists in psychiatry and gynaecology.According to those certificates, although that person was born female, their gender identity was male. Following the recognition of their refugee status on that basis, that person was nevertheless registered as female in the asylum register, which is kept by the Hungarian asylum authority and contains identification data, including gender, of the persons who have obtained that status in Hungary.
In 2022, on the basis of the abovementioned medical certificates, VP requested, inter alia, that the asylum authority rectify the entry in respect of their gender in that register, on the basis of the General Data Protection Regulation (GDPR). [2]
However, that request was rejected on the ground that VP had not proved that they had undergone gender reassignment surgery. VP brought an action against that rejection, before the Budapest High Court (Hungary).
Whilst explaining that Hungarian law does not provide for a procedure for the legal recognition of transgender identity, that court asks the Court of Justice, first, whether the GDPR requires a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate and, second, whether a Member State may, by way of an administrative practice, make the exercise of the right to rectification of those data conditional upon the production of evidence of, in particular, gender reassignment surgery.
In the first place, the Court observes that, under the GDPR and, in particular, the principle of accuracy set out in that regulation, [3] the data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her. That regulation thus gives specific expression to the fundamental right enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), [4] according to which everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
In that regard, the Court recalls that the assessment of whether those data are accurate and complete must be made in the light of the purpose for which those data were collected. In the present case, after observing that the data processing concerned falls within the material scope of the GDPR, the Court indicates that it is for the Hungarian court to verify the accuracy of the data at issue, in the light of the purpose for which they were collected. If the purpose of collecting those data was to identify the data subject, those data would appear to refer to that person’s lived gender identity, and not to the identity assigned to them at birth.
Read as well: Status of long-term resident in Cyprus: Appeal against the rejection decision , Article by Giorgos Kazoleas, Lawyer in Cyprus
In that context, the Court clarifies that a Member State cannot rely on the absence, in its national law, of a procedure for the legal recognition of transgender identity in order to limit the exercise of the right to rectification. Although EU law does not detract from the Member States’ competence in the area of the civil status of persons and the legal recognition of their gender identity, those States must, however, in exercising that competence, comply with EU law, including the GDPR, read in the light of the Charter.
Consequently, the Court concludes that the GDPR must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of that regulation. In the second place, the Court finds that, for the purposes of exercising their right to rectification, that person may be required to provide relevant and sufficient evidence that may reasonably be required in order to establish that those data are inaccurate.
However, a Member State may not, under any circumstances, make the exercise of the right to rectification conditional upon the production of evidence of gender reassignment surgery. Such a requirement undermines, in particular, the essence of the right to the integrity of the person and the right to respect for private life, referred to in Articles 3 and 7 of the Charter respectively.
Furthermore, such a requirement is, in any event, not necessary or proportionate in order to ensure the reliability and consistency of a public register such as the asylum register, since a medical certificate, including a psychiatric diagnosis, may constitute relevant and sufficient evidence in that regard. (source:curia.europa.eu/photo freepik.com)
_______________
1 The name of the present case is a fictitious name. It does not correspond to the real name of any of the parties to the proceedings.
2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
3 See Article 5(1)(d) and Article 16 of the GDPR.
4 See the second sentence of Article 8(2).
Comments
Post a Comment