Gender and GDPR: does the right to rectification override civil registry records?

VP, an Iranian transgender refugee, had his gender recorded as female in Hungarian public asylum register despite identifying himself as male. VP has provided medical certificates from psychiatry and gynaecology specialists confirming his male gender identity.

In 2022, his request for rectification of his personal data (based on Article 16 of the GDPR) was rejected by the Hungarian asylum authority. The authority argued that VP had not provided proof of having undergone gender reassignment surgery and that the certificates only established his transgender identity.

The Hungarian court has addressed two preliminary questions to the CJEU:

• Does the GDPR require the rectification of gender identity data in a public register?
• Can a EU member state require proof of gender reassignment surgery for the data subject to exercise this right of rectification?

The CJEU responded to these two preliminary questions as follows:

• A EU member state cannot invoke the absence of a legal gender recognition procedure in its national law to deny the right to rectification under the GDPR. Consequently, the GDPR (right to rectification) requires a national authority responsible for maintaining a public register to correct gender identity data when it is inaccurate;
• A person requesting rectification of his/her data may be required to provide relevant and sufficient evidence to establish the inaccuracy of such data. However, a member state cannot, through administrative practice, make the exercise of this right conditional on proof of gender reassignment surgery.

The reasoning behind this decision includes the following:

• The right to rectification can only be limited under the conditions set out in Article 23 of the GDPR. A member state may introduce legislative measures imposing restrictions on this right for personal data contained in public registers for reasons of general public interest. However, in this case, no Hungarian law has been expressly adopted to restrict the right to rectify gender in public registers.
• Article 16 of the GDPR does not specify what types of evidence may be required by a data controller to establish the inaccuracy of personal data that an individual seeks to rectify. While “relevant and sufficient” evidence may be required to prove inaccuracy, a member state can only limit the right to rectification in accordance with Article 23 of the GDPR (i.e., through specific legislation). In this case, Hungarian law does not establish any proof requirements for correcting gender identity data in the asylum register. A medical certificate, including a prior psychological diagnosis, may constitute relevant and sufficient evidence.
• Article 8 of the European Convention on Human Rights (ECHR) (right to respect for private and family life) protects a person’s gender identity, which is one of the most intimate aspects of private life. This provision encompasses the right of individuals to determine the details of their human identity, including the right of transgender people to respect and recognition of their gender identity. Accordingly, Article 8 requires states to implement procedures that effectively respect their right to gender identity. In this context, the ECHR has already ruled that the recognition of a transgender person’s gender identity cannot be made conditional on undergoing surgical treatment (see ECHR, January 19, 2021, X and Y v. Romania, §§ 165 and 167).

This case demonstrates that the rights granted under the GDPR are being interpreted increasingly broadly by the CJEU. Their importance even surpasses the prerogatives of public authorities and the principles governing civil registry records, even when the requested rectification does not result from a mistake from the data controller, but relies on the individual’s will.

Authored by Etienne Drouard and Olga Kurochkina.