VP v Országos Idegenrendészeti Főigazgatóság (C-247/23)

Contents

Judgment of the Court (First Chamber)13 March 2025^note(Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Article 5(1)(d) — Principle of accuracy — Article 16 — Right to rectification — Article 23 — Restrictions — Data relating to gender identity — Data incorrect from the time of inclusion in a public register — Means of proof — Administrative practice of requesting proof of gender reassignment surgery)In Case C‑247/23 [Deldits],^noteREQUEST for a preliminary ruling under Article 267 TFEU from the Fővárosi Törvényszék (Budapest High Court, Hungary), made by decision of 29 March 2023, received at the Court on 18 April 2023, in the proceedingsVPvOrszágos Idegenrendészeti Főigazgatóság,THE COURT (First Chamber),composed of K. Lenaerts, President of the Court, acting as President of the First Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, M.L. Arastey Sahún, President of the Fifth Chamber, A. Kumin and I. Ziemele, Judges,Advocate General: A.M. Collins,Registrar: I. Illéssy, Administrator,having regard to the written procedure and further to the hearing on 3 June 2024,after considering the observations submitted on behalf of:– VP, by G. Győző, ügyvéd, E. Polgári, and T.L. Sepsi, ügyvéd,– the Hungarian Government, by M.Z. Fehér and R. Kissné Berta, acting as Agents,– the Estonian Government, by N. Grünberg, acting as Agent,– the Spanish Government, by S. Núñez Silva and A. Pérez-Zurita Gutiérrez, acting as Agents,– the French Government, by R. Bénard, B. Dourthe and B. Fodda, acting as Agents,– the Netherlands Government, by M.K. Bulterman, A. Hanje and J.M. Hoogveld, acting as Agents,– the Portuguese Government, by P. Barros da Costa, A. Pimenta, J. Ramos and Â. Seiça Neves, acting as Agents,– the European Commission, by A. Bouchagiar, H. Kranenborg and Zs. Teleki, acting as Agents,after hearing the Opinion of the Advocate General at the sitting on 12 September 2024,gives the following

Judgment

1This request for a preliminary ruling concerns the interpretation of Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).

2The request has been made in proceedings between VP, a natural person, and the Országos Idegenrendészeti Főigazgatóság (National Directorate-General for Immigration Policing, Hungary; ‘the asylum authority’) concerning the rectification of data, relating to VP’s gender identity, in a public register kept by that authority.

Legal context

European Union law

3Recitals 1, 10, 59 and 73 of the GDPR state:(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.…(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation. ……(59) Modalities should be provided for facilitating the exercise of the data subject’s rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. ……(73) Restrictions concerning specific principles and the [right] of … rectification or erasure of personal data … may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including … the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, … other important objectives of general public interest of the Union or of a Member State, in particular … the keeping of public registers kept for reasons of general public interest, … or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms [signed in Rome on 4 November 1950 (“the ECHR”)].’

4Article 1 of the GDPR, entitled ‘Subject matter and objectives’, provides, in paragraph 2:‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’

5Article 2 of the GDPR, entitled ‘Material scope’, provides, in paragraph 1:‘This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.’

6According to Article 4 of the GDPR, entitled ‘Definitions’:‘For the purposes of this Regulation:(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;…’

7Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides, in paragraph 1:‘Personal data shall be:…(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);…’

8Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:1.Processing shall be lawful only if and to the extent that at least one of the following applies:…(c) processing is necessary for compliance with a legal obligation to which the controller is subject;…(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;…2. Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.3.The basis for the processing referred to in [points] (c) and (e) of paragraph 1 shall be laid down by:(a) Union law; or(b) Member State law to which the controller is subject.The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.…’

9Article 16 of the GDPR, entitled ‘Right to rectification’, provides:‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’

10Article 23 of the GDPR, entitled ‘Restrictions’, provides, in paragraph 1:‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:(a) national security;(b) defence;(c) public security;(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;…(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);…’

Hungarian law

11Paragraph 81 of the a menedékjogról szóló 2007. évi LXXX. törvény (Law No LXXX of 2007 on the right to asylum) of 29 June 2007 (Magyar Közlöny 2007/83; ‘the Law on the right to asylum’) provides:‘The competent authority in asylum matters shall, in the register relating to such matters, process the personal data of refugees, beneficiaries of subsidiary protection, beneficiaries of resettlement schemes, beneficiaries of temporary protection, and also persons seeking international protection and persons subject to the Dublin procedure (together, “persons subject to this law”), information relating to their stay and to the assistance and aid to which they are entitled, as well as subsequent changes to such information, for the purpose of:(a) checking that they have the status of refugees, of beneficiaries of subsidiary protection, of beneficiaries of temporary protection or of beneficiaries of resettlement schemes, and ensuring that they are entitled to enjoy the rights arising from that status;(b) checking their entitlement to the assistance and aid defined in this law and in other legislation;(c) their personal identification;(d) avoiding the duplication of procedures; and(e) detecting whether an application has been submitted more than once.’

12Paragraph 82 of the Law on the right to asylum provides:‘For the purposes of this chapter, the following data of the persons subject to this law shall be regarded as identification data of natural persons:…(f) gender.’

13Under Paragraph 83(1) of that law:‘The register for asylum matters shall contain the following data of the persons subject to this law:(a) identification data of natural persons;…’

14Paragraph 83/A(5) of that law provides:‘The competent authority in asylum matters shall be obliged, of its own motion, to delete entries which are contrary to the regulations, to correct those which are incorrect and to supply any entries omitted from the official register kept by it.’

The dispute in the main proceedings and the questions referred for a preliminary ruling

15VP is an Iranian national who obtained refugee status in Hungary in 2014. In support of their application for that status, VP relied on their transgender identity and produced medical certificates drawn up by specialists in psychiatry and gynaecology. According to those certificates, although VP was born female, their gender identity was male. Following recognition of VP’s refugee status on that basis, VP was nevertheless registered as female in the asylum register which, in accordance with the provisions of the Law on the right to asylum, is kept by the asylum authority and contains identification data, including gender, of the natural persons who have obtained that status.

16In 2022, VP submitted a request to the asylum authority, on the basis of Article 16 of the GDPR, to have the entry in respect of their gender rectified in order to indicate that VP is male and to have their forename amended in the asylum register. VP annexed the abovementioned medical certificates to that request. By decision of 11 October 2022, that authority rejected that request on the ground that (i) VP had not proved that they had undergone gender reassignment surgery, and (ii) the certificates provided established only VP’s transgender identity.

17VP brought an action for annulment of that decision before the Fővárosi Törvényszék (Budapest High Court, Hungary), which is the referring court. In support of VP’s action, VP submits that transgender identity implies, by definition, a change of gender identity and that the medical certificates submitted confirm that change. VP argues that it is apparent from the case-law of the European Court of Human Rights that gender reassignment surgery cannot be required for the purposes of recognising a change of gender identity. Such a requirement is also contrary, in particular, to Articles 3 and 7 of the Charter. VP further submits that several Member States, including the Kingdom of Belgium, the Kingdom of Denmark, Ireland, the Hellenic Republic, the Republic of Malta, the Portuguese Republic and the Kingdom of Sweden, recognise changes in gender identity on the basis of declarations made by the persons concerned. VP states that the medical certificates submitted in support of VP’s action refer to VP’s male appearance and expressly refer, by way of diagnosis, to Code F64.0 of the International Classification of Diseases established by the World Health Organization (WHO), relating to transgender identity.

18The asylum authority contends that the action should be dismissed.

19According to the referring court, while it is true that the Law on the right to asylum contains a general provision regarding the rectification of incorrect entries, that law does not lay down either the procedure or the conditions for recognition of a change of gender identity and/or forename in connection with such a change. In that regard, the Alkotmánybíróság (Constitutional Court, Hungary) held, in its judgment No 6/2018 of 27 June 2018, that the failure of the Hungarian legislature to adopt a procedure allowing persons who are lawfully resident in Hungary, without being Hungarian nationals, to amend the entry relating to their gender and forename, even though such a possibility was available to Hungarian nationals, was unconstitutional. In addition, the European Court of Human Rights held, by its judgment of 16 July 2020, Rana v. Hungary (CE:ECHR:2020:0716JUD004088817), that Hungary had violated the ECHR by not providing for a procedure for the legal recognition of a change of gender identity for refugees. That legal vacuum has persisted since then, despite those judgments.

20That situation is allegedly aggravated by the fact that, since 2020, the possibility of legal recognition of a change in gender identity has ceased to exist for Hungarian nationals. It is precisely because of that lack of possibility of recognition under national law that VP brought their action on the basis of Article 16 of the GDPR. In such a context, the referring court asks whether that article places on the asylum authority an obligation to rectify gender data in the asylum register and, if so, what evidence the data subject would have to provide in support of their request.

21In those circumstances, the Fővárosi Törvényszék (Budapest High Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:(1) Must Article 16 of the GDPR be interpreted as meaning that, in connection with the exercise of the rights of the data subject, the authority responsible for keeping registers under national law is required to rectify the personal data relating to the [gender] of that data subject recorded by that authority, where those data have changed after they were entered in the register and therefore do not comply with the principle of accuracy established in Article 5(1)(d) of the GDPR?(2) If the answer to the first question referred is in the affirmative, must Article 16 of the GDPR be interpreted as meaning that it requires the person requesting rectification of the data relating to his or her [gender] to provide evidence in support of the request for rectification?(3) If the answer to the second question referred is in the affirmative, must Article 16 of the GDPR be interpreted as meaning that the person making the request is required to prove that he or she has undergone [gender] reassignment surgery?’

Consideration of the questions referred

The first question

22By its first question, the referring court asks, in essence, whether Article 16 of the GDPR must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of Article 5(1)(d) of that regulation.

23As a preliminary point, it should be noted that, under Article 16 of the GDPR, the data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

24That provision gives specific expression to the fundamental right enshrined in the second sentence of Article 8(2) of the Charter, according to which everyone has the right of access to data which have been collected concerning him or her, and the right to have them rectified.

25In addition, Article 16 of the GDPR must be read in the light, first, of Article 5(1)(d) of the GDPR, which enshrines the principle of accuracy, under which processed data must be accurate and, where necessary, kept up to date, and that every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay. Second, that provision must also be read in the light of recital 59 of the GDPR, from which it is apparent that modalities should be provided for facilitating the exercise of the data subject’s rights under that regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, rectification of personal data.

26In that regard, it must be noted that, according to the case-law of the Court, the assessment of whether personal data is accurate and complete must be made in the light of the purpose for which those data were collected (see, by analogy, judgment of 20 December 2017, Nowak, C‑434/16, EU:C:2017:994, paragraph 53).

27Lastly, for the purposes of interpreting Article 16 of the GDPR, it should also be noted that the objective pursued by that regulation, as is set out in Article 1 thereof and in recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU (judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 21 and the case-law cited).

28In accordance with that objective, any processing of personal data must, inter alia, comply with the principles relating to the processing of such data set out in Article 5 of the GDPR, including the principle of accuracy recalled in paragraph 25 of the present judgment, but also satisfy the lawfulness conditions listed in Article 6 of that regulation (see, to that effect, judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 22 and the case-law cited).

29In those circumstances, keeping the processed data up to date constitutes an essential aspect of the protection of the data subject with regard to the processing of those data.

30In the present case, it is common ground, first, that the information relating to VP’s gender identity may be classified as ‘personal data’, since it relates to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR, and, second, that those data were the subject of ‘processing’, within the meaning of Article 4(2) of that regulation, since they were collected and registered by the asylum authority in a public register, namely the asylum register. Consequently, such processing, which relates to data contained or intended to form part of a filing system, falls within the material scope of that regulation, pursuant to Article 2(1) thereof (see, by analogy, judgment of 9 January 2025, Mousse, C‑394/23, EU:C:2025:2, paragraph 30).

31Although compliance with the conditions governing the lawfulness of the processing concerned, within the meaning of Article 6 of the GDPR, does not appear to have been called into question in the context of the dispute in the main proceedings, the asylum authority’s compliance with the principle of accuracy set out in Article 5(1)(d) of that regulation is disputed by VP, who seeks rectification of the personal data relating to their gender identity, under Article 16 of that regulation.

32In the light of the case-law referred to in paragraph 26 of the present judgment, it is for the referring court to verify the accuracy of the data at issue in the main proceedings in the light of the purpose for which they were collected and to assess, in particular, in the light of Article 81(c) of the Law on the right to asylum, whether the purpose of collecting those data is to identify the data subject. If that were the case, those data would therefore appear to refer to that person’s lived gender identity, and not to the identity assigned to them at birth. In such a context, contrary to what the Hungarian Government maintains, it is for the controller, in the present case the asylum authority, to take into consideration that person’s gender identity at the time of their registration in the asylum register, and not the gender identity assigned to them at birth.

33Consequently, as the Advocate General observed, in essence, in points 31 and 40 of his Opinion, and in the light of the file before the Court, according to which, in the context of the procedure for granting refugee status, Hungary accepted that VP was a transgender person, the personal data relating to their gender identity, which is set out in the asylum register, appear to have been incorrect from the time of those data being recorded.

34In that regard, contrary to what the Hungarian Government maintains, a Member State cannot rely on specific provisions of national law, adopted on the basis of Article 6(2) and (3) of the GDPR, in order to limit the right to rectification enshrined in Article 8(2) of the Charter and given specific expression in Article 16 of the GDPR.

35First, it is apparent from the third sentence of recital 10 of that regulation that those specific provisions are intended only to further specify the application of the rules contained in the GDPR, and not to derogate from them.

36Second, the right to rectification set out in Article 16 of the GDPR may be restricted only in accordance with the conditions set out in Article 23 of that regulation, read in the light of recital 73 thereof. Thus, a Member State may in particular lay down, by internal legislative measures, restrictions on that right, in respect of personal data set out in public registers kept for reasons of general public interest. However, in the present case, as the Advocate General observed, in essence, in point 44 of his Opinion, it is not apparent from the file before the Court that the Hungarian legislature restricted, whilst complying with the conditions set out in Article 23 of the GDPR, the scope of that right to rectification, or that the asylum authority justified its refusal of the requested rectification by relying on such a statutory restriction. Subject to verification by the referring court, it would appear that that refusal is not based on a legislative measure adopted under Article 23 of the GDPR, but on the finding that VP had not provided proof of their gender identity.

37In any event, a Member State cannot rely on the absence, in its national law, of a procedure for the legal recognition of transgender identity in order to limit the right to rectification. In that regard, it should be noted that, although EU law does not detract from the Member States’ competence in the area of the civil status of persons and the legal recognition of their gender identity, those States must, however, in exercising that competence, comply with EU law. Thus, national legislation which prevents a transgender person, in the absence of recognition of their gender identity, from fulfilling a requirement which must be met in order to be entitled to a right protected by EU law such as, in the present case, the right enshrined in Article 8(2) of the Charter and given specific expression in Article 16 of the GDPR, must be regarded as being, in principle, incompatible with EU law (see, by analogy, judgment of 4 October 2024, Mirin, C‑4/23, EU:C:2024:845, paragraphs 53 and 60 and the case-law cited).

38In the light of all the foregoing considerations, the answer to the first question is that Article 16 of the GDPR must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of Article 5(1)(d) of that regulation.

The second and third questions

39By its second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 16 of the GDPR must be interpreted as meaning that a Member State may, by means of an administrative practice, make the exercise of the right to rectification of the personal data relating to the gender identity of a natural person, which are contained in a public register, conditional upon the production of evidence of, in particular, gender reassignment surgery.

40As the Advocate General observed in point 47 of his Opinion, Article 16 of the GDPR does not specify which evidence may be required by a controller in order to establish the inaccuracy of the personal data which a natural person seeks to have rectified.

41In that context, although the data subject, requesting the rectification of those data, may be required to provide relevant and sufficient evidence which, in the light of the circumstances of the particular case, can reasonably be required of that person in order to establish that those data are inaccurate (see, by analogy, judgment of 8 December 2022, Google (De-referencing of allegedly inaccurate content), C‑460/20, EU:C:2022:962, paragraphs 68 and 72), it must, however, be stated, as recalled in paragraph 36 of the present judgment, that a Member State may restrict the exercise of the right to rectification only in compliance with Article 23 of the GDPR.

42Article 23(1) of the GDPR provides that EU or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34 of that regulation, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 of that regulation, provided, however, that such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society in order to safeguard certain objectives listed in that regulation, such as, inter alia, important objectives of general public interest of the European Union or of a Member State. As stated in paragraph 36 of the present judgment, the right to rectification may be subject to restrictions in the context of the keeping of public registers that are kept for reasons of general public interest, in particular in order to ensure the reliability and consistency of those registers.

43In the present case, it is apparent from the request for a preliminary ruling that the Member State concerned has adopted an administrative practice whereby the exercise, by a transgender person, of their right to rectification of data relating to their gender identity, contained in a public register, is conditional upon the production of evidence of gender reassignment surgery. Such an administrative practice gives rise to a restriction of the right to rectification, which must comply with the conditions referred to in Article 23 of the GDPR, as stated in the preceding two paragraphs of the present judgment.

44First, it must be noted that that administrative practice does not satisfy the requirement that a Member State’s law may restrict the scope of the right provided for in Article 16 of the GDPR only by means of legislative measures. Subject to verification by the referring court, Hungarian law does not appear to contain any legislative measure relating to the evidential requirements applicable to the rectification of data relating to the gender identity of persons who are listed in the asylum register.

45Second, such an administrative practice undermines the essence of the fundamental rights guaranteed by the Charter and, in particular, the essence of the right to the integrity of the person and the right to respect for private life, referred to in Articles 3 and 7 of the Charter respectively.

46In that regard, it should be noted that, in accordance with Article 52(3) of the Charter, the rights guaranteed by the Charter have the same meaning and the same scope as the corresponding rights guaranteed by the ECHR, the latter constituting a minimum threshold of protection (see, to that effect, judgment of 4 October 2024, Mirin, C‑4/23, EU:C:2024:845, paragraph 63 and the case-law cited).

47It is apparent from the settled case-law of the European Court of Human Rights that Article 8 ECHR, which corresponds to Article 7 of the Charter, protects a person’s gender identity, which is a constituent element and one of the most intimate aspects of their private life. Thus, that provision encompasses the right to establish details of their identity as individual human beings, which includes the right of transgender people to personal development and physical and moral integrity and to respect for and recognition of their gender identity. To that end, Article 8 imposes positive obligations on States, in addition to negative obligations to protect transgender persons against arbitrary interference by public authorities, which also entails the establishment of effective and accessible procedures guaranteeing effective respect for their right to gender identity. Furthermore, in view of the particular importance of that right, States have only limited discretion in this area (see, to that effect, judgment of 4 October 2024, Mirin, C‑4/23, EU:C:2024:845, paragraphs 64 and 65 and the case-law cited).

48In that context, the European Court of Human Rights has held, inter alia, that the recognition of the gender identity of a transgender person cannot be made conditional on the completion of surgical treatment not desired by that person (see, to that effect, ECtHR, 19 January 2021, X and Y v. Romania, CE:ECHR:2021:0119JUD000214516, §§ 165 and 167 and the case-law cited).

49Third and lastly, an administrative practice such as that at issue in the main proceedings is not, in any event, either necessary or proportionate in order to ensure the reliability and consistency of a public register, such as the asylum register, since a medical certificate, including a psychiatric diagnosis, may constitute relevant and sufficient evidence in that regard (see, to that effect, ECtHR, 6 April 2017, A.P., Garçon and Nicot v. France, CE:ECHR:2017:0406JUD007988512, §§ 139 and 142).

50In the light of the foregoing considerations, the answer to the second and third questions is that Article 16 of the GDPR must be interpreted as meaning that, for the purposes of exercising the right to rectification of the personal data relating to the gender identity of a natural person that are contained in a public register, that person may be required to provide relevant and sufficient evidence that may reasonably be required of that person in order to establish that those data are inaccurate. However, a Member State may not, under any circumstances, by way of an administrative practice, make the exercise of that right conditional upon the production of evidence of gender reassignment surgery.

Costs

51Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

Operative part

On those grounds, the Court (First Chamber) hereby rules:

1.Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)must be interpreted as requiring a national authority responsible for keeping a public register to rectify the personal data relating to the gender identity of a natural person where those data are inaccurate, within the meaning of Article 5(1)(d) of that regulation.

2.Article 16 of Regulation 2016/679must be interpreted as meaning that, for the purposes of exercising the right to rectification of the personal data relating to the gender identity of a natural person that are contained in a public register, that person may be required to provide relevant and sufficient evidence that may reasonably be required of that person in order to establish that those data are inaccurate. However, a Member State may not, under any circumstances, by way of an administrative practice, make the exercise of that right conditional upon the production of evidence of gender reassignment surgery.