VP, an Iranian national, obtained refugee status in Hungary in 2014 based on transgender identity. According to the medical, psychiatric, and gynaecological certificates submitted, although the applicant was born female, VP’s gender identity was male. The applicant was nonetheless registered as female in the asylum register containing identification data, including gender, of the natural persons who have obtained refugee status.

In 2022, the applicant submitted a request to the asylum authority based on Article 16 of the General Data Protection Regulation (GDPR), to have the entry in respect of gender rectified to indicate male. On 11 October 2022, the National Directorate-General for Aliens Policing rejected the request on the ground that the applicant did not prove gender reassignment surgery, and that the certificates provided established only the applicant’s transgender identity. The applicant brought an action for annulment before the Budapest High Court claiming that transgender identity implies a change of gender identity and that the medical certificates submitted confirm that change. Moreover, VP claimed that, according to the case-law of the European Court of Human Rights (ECtHR) gender reassignment surgery cannot be required for the purposes of recognising a change of gender identity, and that several Member States recognise such changes based on declarations made by the persons concerned. The Budapest High Court decided to refer to the European Union Court of Justice (CJEU) for a preliminary ruling on the following questions:

1.    Must Article 16 of the GDPR be interpreted as requiring the responsible authority to rectify an individual’s personal data, including gender, when such data changed after being recorded in line with the obligation from the principle of accuracy in Article 5(1)(d) GDPR?

2.    If the answer to the first question is yes, does Article 16 of the GDPR imply that the person requesting rectification of the data relating to his or her gender need to provide evidence in support of the request?

3.    If the answer to the second question is yes, does Article 16 of the GDPR imply that the person making the request is required to prove that he or she has undergone gender reassignment surgery? 

Regarding the first question, the CJEU ruled that Article 16 of the GDPR required a national authority responsible for maintaining a public register to rectify inaccurate personal data concerning a natural person's gender identity. It clarified that a Member State cannot rely on specific provisions of national law or on the absence of a national procedure for the legal recognition of transgender identity to limit the right to rectification. Article 16 (right to rectification) might be only restricted considering the conditions of Article 23 of the GDPR.

As a preliminary point, the court noted that under Article 16 of the GDPR, the data subject has had the right to obtain from the data controller without undue delay the rectification of inaccurate personal data, or the completion of incomplete personal data. Furthermore, the court held that Article 16 of the GDPR had to be read in light of Article 5(1)(d) of the GDPR which enshrines the principle of accuracy, and Preamble No 59 of the GDPR. Citing previous case law, the court reminded that the assessment of whether personal data is accurate and complete must be made in the light of the purpose for which those data were collected. It concluded that keeping processed data updated constitutes an essential aspect of the protection of the data subject regarding the processing of those data. 

The CJEU noted that the information relating to the applicant’s gender identity may be classified as “personal data” since it relates to an identifiable natural person, and that those data were the subject of processing, since they were collected and registered by the asylum authority in a public register. The court considered that in such context the data controller, that is, the asylum authority had to take into account the applicant’s gender identity at the time of their registration, and not the gender identity assigned to them at birth.

Then, the CJEU examined the second and third questions together. It noted the Advocate General’s observation that Article 16 of the GDPR does not specify which evidence may be required by a data controller to establish the inaccuracy of personal data which are sought to be rectified. The CJEU ruled that, in being required sufficient and relevant evidence to prove such inaccuracy, Member States must not restrict the right to rectification beyond the conditions set out in Article 23 of the GDPR. Specifically, that the restriction is a legislative measure which respects fundamental rights and freedoms, and which is necessary and proportionate in a democratic society. It held that the administrative practice implemented by Hungary, specifically the requirement for transgender individuals to provide proof of gender reassignment surgery to rectify their gender identity data, did not comply with the conditions set out in Article 23 of the GDPR. It ruled that such practice undermines the essence of the right to the integrity of the person and the right to respect for private life. In concluding this, the court referenced X and Y v Romania (19 January 2021) in which it was held that the recognition of the gender identity of a transgender person cannot be made conditional on the completion of surgical treatment not desired by that person. The court furthermore held that such a practice is not, in any event, either necessary or proportionate to ensure the reliability and consistency of the asylum register, since a medical certificate, including a psychiatric diagnosis, may constitute relevant and sufficient evidence in that regard.  

The CJEU concluded that under Article 16 of the GDPR, a person seeking to rectify gender identity data in a public register may be required to provide reasonable evidence of inaccuracy. However, a Member State cannot impose an administrative requirement demanding proof of gender reassignment surgery to exercise this right.