62023CC0247
OPINION OF ADVOCATE GENERAL
COLLINS
delivered on 12 September 2024 (
1
)
Case C‑247/23 [Deldits] (
i
)
VP
v
Országos Idegenrendészeti Főigazgatóság
(Request for a preliminary ruling from the Fővárosi Törvényszék (Budapest High Court, Hungary))
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 16 – Right to rectification of inaccurate personal data – Data relating to the gender of a transgender refugee – Scope)
I. Introduction
1.
May Article 16 of the General Data Protection Regulation (
2
) – on the right to rectification – read in the light of Article 5(1)(d) thereof – on the principle of accuracy – require the body that maintains a national register of refugees to rectify personal data it recorded of a person’s gender? If it is so required, what evidence can it demand of a person who applies to rectify that record? The Fővárosi Törvényszék (Budapest High Court, Hungary) seeks answers to these questions.
II. Legal Framework
A.
The GDPR
2.
Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, states:
‘1.   Personal data shall be:
…
(d)
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
…’
3.
Under Article 16 of the GDPR, entitled ‘Right to rectification’:
‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’
4.
Article 23 of the GDPR, headed ‘Restrictions’, provides:
‘1.   Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
(a)
national security;
(b)
defence;
(c)
public security;
(d)
the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
(e)
other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation … matters, public health and social security;
(f)
the protection of judicial independence and judicial proceedings;
(g)
the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
(h)
a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
(i)
the protection of the data subject or the rights and freedoms of others;
(j)
the enforcement of civil law claims.
…’
B.
Hungarian Law
5.
Paragraph 81 of the menedékjogról szóló 2007. évi LXXX. törvény (Law LXXX of 2007 on the right to asylum) (‘the Asylum law’) (
3
) is in the terms following:
‘The competent authority in asylum matters shall, in the register relating to such matters, process the personal data of refugees, beneficiaries of subsidiary protection, beneficiaries of resettlement schemes, beneficiaries of temporary protection, and also persons seeking international protection and persons subject to the Dublin procedure (together, “persons subject to this law”), information relating to their stay and to the assistance and aid to which they are entitled, as well as subsequent changes to such information, for the purpose of:
(a)
checking that they have the status of refugees, of beneficiaries of subsidiary protection, of beneficiaries of temporary protection or of beneficiaries of resettlement schemes, and ensuring that they are entitled to enjoy the rights arising from that status;
(b)
checking their entitlement to the assistance and aid defined in this law and in other legislation;
(c)
their personal identification;
(d)
avoiding the duplication of procedures; and
(e)
detecting whether an application has been submitted more than once.’
6.
Paragraph 82(f) of that law provides:
‘For the purposes of this chapter, the following data of the persons subject to this law shall be regarded as identification data of natural persons:
…
(f) [sex/gender].’
7.
Under Paragraph 83(1)(a) of that law:
‘The register for asylum matters shall contain the following data of the persons subject to this law:
(a)
identification data of natural persons;’
…’
8.
Paragraph 83A(5) of the Asylum law provides that:
‘The competent authority in asylum matters shall be obliged, of its own motion, to delete entries which are contrary to the regulations, to correct those which are incorrect and to supply any entries omitted from the official register kept by it.’
III. The dispute in the main proceedings and the questions referred for a preliminary ruling
9.
In 2014, the competent authority in Hungary granted V.P. (‘the applicant’) (
4
) – an Iranian national who was ‘born a woman’ – refugee status. In the procedure which led to that decision, the applicant relied on their transsexuality as the ground for their recognition as a refugee and tendered certificates from specialists in psychiatry and gynaecology by way of proof. Upon recognition of their refugee status, the Országos Idegenrendészeti Főigazgatóság (National Directorate-General for Immigration Policing; Hungary, ‘the defendant’) recorded personal data, including gender, in the asylum register that it maintained in order to facilitate the applicant’s identification. The record states that the applicant is female.
10.
In 2022, the applicant, pursuant to Article 16 of the GDPR, submitted a request to the defendant to rectify the asylum register in two particulars: a change of the name under which they had been registered and a change of gender from female to male. In support of that request, the applicant furnished the same medical evidence that they had submitted in the asylum procedure. By decision of 11 October 2022 (‘the decision’), the defendant rejected that request. It stated that the documents provided merely confirmed that the applicant was transgender. The documents did not prove that they had undergone gender reassignment surgery and that the applicant’s gender had changed.
11.
The applicant brought proceedings before the referring court for the annulment of the decision. At all material times, the applicant has identified as male. They claimed that, from a conceptual viewpoint, transsexuality involves a change of gender. The medical reports submitted confirm that the applicant has a male appearance and that they were diagnosed under code F64.0 of the International Classification of Diseases, which reference corresponds to transsexualism. Relying on the case-law of the ECtHR (
5
), the applicant submitted that surgery is unnecessary for gender reassignment. The rectification procedure under Article 16 of the GDPR does not require a person to produce ‘excessive evidence’, in particular, certification that they have undergone surgery for the purposes of gender reassignment. In any event, that requirement is contrary to the case-law of the ECtHR. It also violates Article 1 (right to human dignity), Article 3 (right to the integrity of the person), Article 7 (right to respect for private and family life) and Article 52(3) (principle of equivalent protection of fundamental rights) of the Charter of Fundamental Rights of the European Union (‘the Charter’). The applicant also drew attention to the fact that a number of Member States (
6
) recognise a declaration by a transgender person as legal proof of their gender identity.
12.
The defendant claims that the action should be dismissed. It submits that the applicant has provided neither public document nor medical evidence to certify an asserted change of gender.
13.
The referring court considers that an interpretation of Article 16 of the GDPR is necessary to clarify the conditions under which a data subject may seek to rectify data recorded in respect of their gender. While the Asylum law envisages processing alterations to recorded data and the correction of erroneous entries, it regulates neither the procedure nor the requirements whereby a change of gender or a consequent name change may be recorded.
14.
In its judgment of 27 June 2018, the Alkotmánybíróság (Constitutional Court, Hungary) (
7
) declared that the failure of the Hungarian legislature to adopt a procedure to enable lawfully settled non-Hungarian citizens to change their gender and their name, while affording Hungarian citizens that possibility, was unconstitutional as an infringement of Article II (inviolability of human dignity) and Article XV(2) (prohibition of discrimination) of the Magyarország Alaptörvény (Fundamental Law of Hungary). The Alkotmánybíróság (Constitutional Court) called upon the Hungarian Parliament to remedy that default by 31 December 2018 at the latest. In its judgment of 16 July 2020, Rana v. Hungary, (
8
) the ECtHR declared that Hungary had violated Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, (‘the ECHR’) by failing to grant a refugee access to a procedure to facilitate legal recognition of a change of gender.
15.
The Fővárosi Törvényszék (Budapest High Court) recalls that, notwithstanding the judgments of the Alkotmánybíróság (Constitutional Court) and of the ECtHR, Hungarian legislation does not make a procedure for the legal recognition of a change of gender available to persons who are lawfully resident in Hungary but who do not have the nationality of that Member State. In the wake of the judgment of the Alkotmánybíróság (Constitutional Court), Hungary no longer affords legal recognition to a citizen’s change of gender. The referring court is accordingly of the view that it is unable to ‘fill the gap in the law by means of the analogous application of the provisions relating to Hungarian citizens.’
16.
The Fővárosi Törvényszék (Budapest High Court) thus decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1)
Must Article 16 of the GDPR be interpreted as meaning that, in connection with the exercise of the rights of the data subject, the authority responsible for keeping registers under national law is required to rectify the personal data relating to the gender of that data subject recorded by that authority, where those data have changed after they were entered in the register and therefore do not comply with the principle of accuracy established in Article 5(1)(d) of the GDPR?
(2)
If the answer to the first question referred is in the affirmative, must Article 16 of the GDPR be interpreted as meaning that it requires the person requesting rectification of the data relating to his or her gender to provide evidence in support of the request for rectification?
(3)
If the answer to the second question referred is in the affirmative, must Article 16 of the GDPR be interpreted as meaning that the person making the request is required to prove that he or she has undergone gender reassignment surgery?’
IV. The procedure before the Court
17.
The applicant, the Estonian, Spanish, French, Hungarian, Netherlands and Portuguese Governments and the European Commission submitted written observations.
18.
The applicant’s written observations indicated that they had acquired Hungarian citizenship ‘in the meantime’ and that their enrolment in the asylum register was no longer required. Pursuant to Article 101(1) of the Rules of Procedure of the Court of Justice, the Court asked the referring court to clarify the impact of that change of circumstances upon the main proceedings. The referring court replied that it had no impact on the outcome of those proceedings since, pursuant to Article 85(2) of the közigazgatási perrendtartásról szóló 2017. évi I. törvény (Law No I of 2017 establishing the Code of Administrative Procedure), (
9
) that court ‘shall review the lawfulness of the administrative activity in accordance with the facts prevailing at the time of its implementation’.
19.
The applicant, the Spanish, French, Hungarian, and Netherlands Governments and the Commission presented oral argument and replied to the Court’s questions at the hearing on 3 June 2024.
V. Assessment
A.
The first question
1. Submissions on the first question
20.
The applicant contends that, pursuant to Article 5(1)(d) of the GDPR, the accuracy of data must be assessed having regard to the purposes for which they are processed. The purpose of the asylum register is to identify those persons whom Hungary recognises as refugees. Where the gender of a transgender person as recorded does not reflect the identity by which they are recognised in public, as opposed to their legal identity, that record does not facilitate their identification and may even expose them to discrimination and harassment. Article 16 of the GDPR must be so interpreted as to facilitate rectification of data on the gender of transgender persons.
21.
By reference to Article 5(1)(d), Article 6(2) and Article 16 of the GDPR, the Estonian Government contends that Member States must introduce national procedural rules that enable a person, who has experienced gender reassignment, to seek rectification of personal data in a public register that have become inaccurate in the light of the purposes for which they were processed.
22.
The Spanish Government submits that national legislation on the legal recognition of transgender identity, which imposes conditions on persons who seek to rectify personal data on their gender recorded in public registers, limits the exercise of the right of rectification contained in Article 16 of the GDPR. Although such limitations may be justified by the necessity to safeguard the interests to which Article 23 of the GDPR refers, Hungary may not rely upon that provision because it has not enacted legislation to recognise the gender of transgender persons. In any event, the various interests to which that provision refers do not apply in the circumstances of the case before the referring court.
23.
Since the applicant has refugee status, the Spanish Government further submits that provisions of EU law other than the GDPR are relevant to this reference for a preliminary ruling, such that the Court ought to reformulate the first question. Amongst the measures that the Court should interpret in this context are Articles 7 and 21 of the Charter and Article 24(1) (
10
) and Article 25(1) (
11
) of Directive 2011/95. (
12
) The Spanish Government pleads that those provisions preclude a national legal system that does not ‘provide for any procedure enabling a person with refugee status and having a transgender identity to change the reference to their gender in the asylum register.’ The absence of such a procedure also infringes the case-law of the ECtHR. (
13
) The Spanish Government relies, by analogy, on the Freitag judgment (
14
), which concerned a Member State’s refusal to recognise a name change made by another Member State. There the Court held that the confusion and inconvenience that arose from the divergence between the two names used in respect of the same person hindered the exercise of the right, enshrined in Article 21 TFEU, to move and reside freely in the territories of the Member States. According to the Spanish Government, a discrepancy between the female gender recorded on a residence permit or travel documents issued pursuant to Article 24(1) and Article 25(1) of Directive 2011/95 and the applicant’s identification as male – which the referring court found was consistent with their conduct and physical appearance – could give rise to confusion and doubt as to the applicant’s identity and the authenticity of those documents.
24.
The French Government makes a distinction between data that was inaccurate at the time that it was recorded and data that subsequently becomes inaccurate. It submits that, pursuant to Article 5(1)(d) and Article 16 of the GDPR, data relating to gender may be rectified with retroactive effect if it was inaccurate at the time it was recorded. In registers that record civil status, public authorities may have an interest in following the evolution of data on a person’s identity. Any procedure to facilitate such rectification may thus be designed so as to leave a trace of all data entered in those registers. (
15
)
25.
The Hungarian Government considers that Article 16 of the GDPR, read in the light of Article 5(1)(d) of the GDPR and Article 8(2) of the Charter, confers a right on a person to rectify data on gender that does not correspond to reality. No difficulty would have arisen had the applicant sought to rectify data on their gender that had been registered incorrectly at the outset. Since, in the Hungarian Government’s view, the applicant seeks to rectify correctly recorded data, Article 16 of the GDPR does not apply. In support of that approach, that government draws an analogy with the Nowak judgment (
16
) in which the Court held that incorrect answers on an exam script are incapable of rectification.
26.
The Netherlands Government observes that the absence of an efficient procedure for the legal recognition of the change of a person’s gender constitutes a breach of Article 3 (Right to the integrity of the person) and Article 7 (Respect for private and family life) of the Charter. The absence of such a procedure is an obstacle to the applicant’s exercise of the right to rectify data on their gender pursuant to Article 16 of the GDPR.
27.
The Portuguese Government considers that Article 16 of the GDPR, interpreted in the light of Articles 1, 3, 7, 8 and 21 of the Charter, requires data subjects to be permitted to rectify data on their gender recorded for the purposes of their identification where that data has changed since its initial registration.
28.
The Commission submits that the first question is based on the premiss that the data in the asylum register on the applicant may be inaccurate. That assumption raises the issue as to whether the accuracy of data on a person’s gender is subject to the legal recognition of gender reassignment. In the light of Article 8 of the ECHR, Articles 7 and 8 of the Charter and the case-law of the ECtHR, (
17
) the Commission is of the view that the absence of a system for the recognition of gender reassignment may not impede rectification of inaccurate data on a person’s gender in a public register. In such circumstances, Article 16 of the GDPR, read in conjunction with Articles 7 and 8 and Article 52(1) of the Charter, requires that the authority responsible for keeping that record rectify personal data on the gender of the data subject once those data have become inaccurate.
2. Scope of the first question
29.
The first question from the Fővárosi Törvényszék (Budapest High Court) is based on the premiss that the data on the applicant’s gender in the asylum register were correctly recorded and that those data became inaccurate due to a change in circumstances since that record came into existence. The referring court thus asks whether Article 16 of the GDPR confers a right to rectify that personal data to reflect a change of gender by a transgender person.
30.
The Article 267 TFEU procedure is an instrument for cooperation between the Court of Justice and national courts, by means of which the former provides an interpretation of EU law that enables the latter to rule upon proceedings pending before them. In the context of that cooperation, the Court affords a presumption of relevance to questions from national courts that relate to EU law. The Court thus refuses to rule on such questions only where it is quite obvious that the interpretation of EU law sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer thereto. Since the Court’s jurisdiction in preliminary rulings is to assist in the administration of justice in the Member States and not to deliver advisory opinions on general or hypothetical questions, it may reformulate the questions referred to it. (
18
)
31.
In this case, I discern a significant difference between the facts that the referring court describes in the order for reference and the text of the first question. These facts disclose that the applicant’s change of gender identity occurred prior to the recognition of their refugee status in 2014, such that that change of gender identity appears to have been the basis upon which Hungary recognised the applicant’s refugee status. (
19
) It further appears that there has been no evolution or change in the applicant’s gender since 2014. The record of the applicant’s gender in the asylum register was, accordingly, incorrect at the time it was entered therein. The case before the referring court is thus one where the data to be rectified was recorded incorrectly at the outset and not one where it became inaccurate ‘after’ (
20
) the creation of that record. The application before the referring court thus seeks to correct an original error and not to amend that record in order to reflect a change in circumstances.
32.
In order to avoid answering a hypothetical question that would take it outside of the jurisdiction that Article 267 TFEU confers upon it, I advise that the Court take account of the facts that underlie the order for reference when it delivers its response to the first question. (
21
)
33.
Contrary to the Spanish Government’s observations, I consider that the questions from the Fővárosi Törvényszék (Budapest High Court) do not seek to ascertain whether EU law requires a Member State to establish a legal framework to facilitate recognition of a change of gender identity of a person whom it recognises as a refugee. The request for a preliminary ruling expressly inquires into the nature and scope of the right to rectify inaccurate data under Articles 5 and 16 of the GDPR. An interpretation of those provisions, in the light of the facts the referring court describes, is thus sufficient to enable it to determine the main proceedings. In that context, I observe that the Fővárosi Törvényszék (Budapest High Court) did not refer any question with respect to the application to rectify the applicant’s name in the asylum register, such that it seems that application was incidental to the application to change the record of their gender. The request for a preliminary ruling thus does not address the possible application of Article 16 of the GDPR in the context of an application to change the record of a name. (
22
) Nor do the present proceedings afford the Court an opportunity to interpret Article 24(1) and Article 25(1) of Directive 2011/95. The order of the Fővárosi Törvényszék (Budapest High Court) neither mentioned those provisions nor provided any details of residence permits or travel documents that may have been issued to the applicant in accordance therewith. (
23
)
3. The right to rectification
34.
It is apparent from Article 1(2) of the GDPR, read in conjunction with recitals 4 and 10 thereof, that the GDPR has, inter alia, the purpose to ensure a high level of protection of the fundamental rights and freedoms of natural persons with regard to the processing of their personal data within the European Union. The GDPR creates a legal framework in order to implement the requirements of Article 8 of the Charter on the protection of personal data in particular. It is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter. (
24
)
35.
The GDPR has a very broad material scope. By its Article 2(1), the GDPR applies ‘to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’ without any distinction as to the identity of the person who carried out that processing. Subject to the exceptions laid down in Article 2(2) thereof, upon which the defendant does not appear to rely, the GDPR applies to processing operations carried out by private persons and by public authorities. (
25
)
36.
The definition of ‘personal data’ in point 1 of Article 4 of the GDPR does not refer to a natural person’s ‘sex’ or ‘gender’ as a factor that may, directly or indirectly, identify a natural person. The expression ‘any information’ in the definition of ‘personal data’ in that provision nonetheless gives that concept a broad scope. (
26
) The reference to ‘factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’ appears to be sufficiently wide as to encompass a natural person’s gender. (
27
) It follows that the registration of the applicant’s personal data, including gender, in a public register of persons recognised as having refugee status, constitutes the ‘processing’ of personal data for the purposes of point 2 of Article 4 of the GDPR.
37.
Under Article 5(1)(a), (b), (c) and (d) of the GDPR, personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject; be collected for specified, explicit and legitimate purposes; be adequate, relevant and not excessive in relation to those purposes; and be accurate and, where necessary, kept up to date. (
28
) By Article 5(1)(d) of the GDPR, the processing of personal data ‘shall’ be accurate. Every reasonable step must be taken to ensure that personal data that are inaccurate having regard to the purposes for which they are processed are erased or rectified without delay.
38.
Article 6(1) of the GDPR sets out an exhaustive list of the cases where the processing of personal data is lawful. (
29
) Processing of personal data in an asylum register is, in principle, lawful by virtue of point (e) of the first subparagraph of Article 6(1) of the GDPR. In accordance with Article 6(2) of the GDPR, Member States may maintain or adopt specific provisions to adapt the application of that regulation’s rules to processing under point (e) of the first subparagraph of Article 6(1) to ensure that such processing is lawful and fair. By Article 6(3) of the GDPR, processing pursuant to point (e) of the first subparagraph of Article 6(1) must be based on EU law or on the law of a Member State to which the controller is subject. That legal basis must also be in the public interest and proportionate to the legitimate aim that it pursues. (
30
) Nothing in the file before the Court suggests that the entry and maintenance of a record of a refugee’s gender in the asylum register in Hungary does not comply with Article 6 of the GDPR. (
31
)
39.
Article 8(2) of the Charter provides, inter alia, that ‘everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified’. Article 16 of the GDPR reflects that right. (
32
) The right of rectification and its enforcement at the initiative of private individuals (
33
) assist in effecting compliance with the principle of accuracy laid down in Article 5(1)(d) of the GDPR.
40.
Since the accuracy of personal data may vary depending on the context in which it is processed, the purpose of the collection of data has a direct bearing upon an assessment of its accuracy. (
34
) One of the enumerated purposes of the asylum register in Hungary is to identify a person (
35
) and ‘gender’ is deemed as ‘data which identifies a physical person’. (
36
) In 2014, when Hungary recognised the applicant’s refugee status, they identified as a transgender male. The competent Hungarian authorities accepted the evidence the applicant submitted in support of that gender identity. The entry of the applicant’s gender as ‘female’ in the asylum register thus appears to have been inaccurate for the purposes of Article 5(1)(d) of the GDPR.
41.
As a matter of first principle, such a record must be capable of rectification by virtue of Article 16 of the GDPR, read in the light of Article 5(1)(d) thereof. (
37
) Whatever considerations may arise as regards the application of those provisions to the rectification of a record that was correct at the time it was created (which raises the issue of the extent of the duty the GDPR places on data controllers to keep data updated and to process it dynamically), if those provisions did not give data subjects a right to have rectified a record that was demonstrably inaccurate at the time it was created, they would appear to serve no purpose.
42.
The Hungarian Government nevertheless submits that, according to Article 6(2) and (3) of the GDPR, the data subject’s right to have an entry in an official record, such as the asylum register, rectified may be exercised under the law of a Member State only and not by direct reliance upon Article 16 of the GDPR.
43.
While the combined provisions of point (e) of the first subparagraph of Article 6(1), and Article 6(2) and (3) of the GDPR grant Member States a ‘margin of manoeuvre’ (
38
) so as to allow them to maintain or to introduce more specific provisions in order to ‘adapt’ (
39
) the rules of the GDPR on the basis of which controllers may lawfully process personal data in the performance of a task carried out in the public interest or in the exercise of official authority, (
40
) contrary to the Hungarian Government’s submissions, Article 16 of the GDPR makes it clear that the lawful processing of data under point (e) of the first subparagraph of Article 6(1) thereof is subject to the right to rectification. Unlike other provisions of the GDPR on the rights of data subjects, Article 16 of the GDPR does not specify the manner in which the right of rectification is to be exercised in the light of certain provisions of Article 6 thereof. (
41
) In any event, Member States’ powers to maintain or to introduce such provisions may not derogate from the right to rectification enshrined in Article 8(2) of the Charter. That Member States may establish a legal framework to ensure the practical application of the right to rectification pursuant to Article 16 of the GDPR in respect, inter alia, of public registers kept for reasons of general public interest in accordance with point (e) of the first subparagraph of Article 6(1) thereof, cannot in any way limit access to, or the enjoyment of, the right to rectification. (
42
)
44.
It is nevertheless the case that the right to rectification, read in the light of the principle of accuracy in Article 5(1)(d) of the GDPR, is not absolute and its exercise may be limited under certain conditions. (
43
) Article 23 of the GDPR lists a number of circumstances in which that right, amongst others that data subjects enjoy, may be restricted. The request for a preliminary ruling does not refer to that provision, nor does the Hungarian Government rely on it in its written submissions with a view to delimiting the application of Article 16 of the GDPR in the circumstances that give rise to this reference. Article 23(1)(e) (
44
) and recital 73 of the GDPR provide, inter alia, that Union or Member State law to which the data controller or processor is subject may restrict the scope of the obligations and rights for which Articles 5 and 16 thereof provide ‘to safeguard … other important objectives of general public interest of the Union or of a Member State’, such as the ‘keeping of public registers kept for reasons of general public interest’. (
45
) Such a restriction must be contained in a legislative measure, respect the essence of the fundamental rights and freedoms and constitute a necessary and proportionate measure in a democratic society. (
46
) A Member State may thus rely on Article 23(1)(e) of the GDPR to restrict the right to rectification in certain circumstances in order to ensure the reliability and consistency of public records, including records of civil status. (
47
) That of itself cannot be an obstacle to granting an application to rectify the applicant’s gender in an asylum register so as to record their gender identity as it was at the time it was entered therein. To accede to an application of that nature only serves to enhance the reliability of that register and the accuracy of the data recorded therein. (
48
)
45.
I therefore advise the Court that Article 16 of the GDPR, read in the light of Article 5(1)(d) thereof, is to be interpreted as meaning that a national authority responsible for keeping a register of refugees is, upon application, required to rectify personal data on the gender of a refugee which that authority had incorrectly recorded at the time they were entered in that register.
B.
The second and third questions
46.
The second and third questions inquire as to the evidence a person who seeks to rectify a record of his or her gender pursuant to Article 16 of the GDPR must submit in support of that request and whether that person may be required to furnish proof of having undergone gender reassignment surgery. These questions can be examined together.
47.
Article 16 of the GDPR does not specify what, if any, proof a data subject must submit to obtain ‘from the controller without undue delay the rectification of inaccurate personal data concerning him or her’. This reflects the reality that the (in)accuracy of data, and the need for their rectification, is to be assessed on a case-by-case basis, as a consequence of which the evidence that may be required for that purpose will vary. Given the broad definition of ‘controller’ in point 7 of Article 4 of the GDPR, which includes public authorities and natural persons, rules or modalities on the right to rectification may be contained in legislation (
49
) or decided on an ad hoc basis so as to address individual circumstances. It follows that a person who seeks rectification of data may be required to produce evidence that may be reasonably required to establish the inaccuracy of that data in the light of the purposes for which they were collected or processed. (
50
) It must be emphasised that the data subject does not have to claim or to demonstrate a particular interest in the rectification of inaccurate data or that the alleged inaccuracy causes any harm. In the present case, subject to verification by the referring court, I consider that it is sufficient that the applicant produce evidence to show that Hungary recognised their refugee status in 2014 on the basis of their pre-existing transgender identity and that the asylum register does not accurately record that identity. (
51
)
48.
The GDPR does not impose any requirement that the applicant show that they have undergone gender reassignment surgery. The ECtHR has repeatedly condemned the imposition of such a requirement, holding that ‘making the recognition of transgender persons’ gender identity conditional on sterilisation surgery or treatment – or surgery or treatment very likely to result in sterilisation – which they do not wish to undergo therefore amounts to making the full exercise of their right to respect for their private life under Article 8 of the [ECHR] conditional on their relinquishing full exercise of their right to respect for their physical integrity as protected by that provision and also by Article 3 of the [ECHR].’ (
52
) In many instances, the imposition of such a requirement would have the effect of negating the right to rectify inaccurate data on the gender of a transgender person pursuant to Article 16 of the GDPR. (
53
) A requirement to produce such evidence would also, in my view, undermine human dignity which, in accordance with Article 1 of the Charter, is inviolable and must be respected and protected. Such a requirement is equally incompatible with Article 3(1) of the Charter, which states that ‘everyone has the right to respect for his or her physical and mental integrity’ and Article 7 of the Charter (respect for private and family life). In that context, I would add that national courts are bound to respect the rights recognised in the Charter when they apply the GDPR.
VI. Conclusion
49.
In the light of the foregoing, I propose that the Court answer the questions referred by the Fővárosi Törvényszék (Budapest High Court, Hungary) as follows:
Article 16 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation), read in the light of Article 5(1)(d) thereof,
must be interpreted as meaning that a national authority responsible for keeping a register of refugees:
(1)
is required, upon application, to rectify personal data on the gender of a refugee which that authority had inaccurately recorded at the time they were entered in that register;
(2)
may require a person requesting rectification of data to produce evidence to establish the inaccuracy of that data in the light of the purposes for which they were collected or processed but may not be required to adduce evidence of having undergone gender reassignment surgery.
(
1
)	Original language: English.
(
i
)	The name given to the present case is fictitious and does not correspond to the name of any party to the proceedings.
(
2
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
(
3
)	Magyar Közlöny, 2007/83.
(
4
)	According to the Oxford Dictionary of English, Second Edition, Revised (2005), the gender neutral pronouns ‘they’, ‘them’ and ‘their’ may be used ‘to refer to a person of unspecified sex’. In order not to prejudice the referring court’s fact-finding task pursuant to Article 267 TFEU, the present Opinion refers to the applicant accordingly. This is a conscious departure from the practice of the European Court of Human Rights (‘the ECtHR’), the judgments of which, on gender identity issues, adopt the pronouns applicants use in their pleadings, notwithstanding the outcome of the proceedings before it.
(
5
)	See, in particular, the judgments of 6 April 2017, A.P., Garçon and Nicot
v. France (CE:ECHR:2017:0406JUD007988512) and of 11 October 2018. S.V. v. Italy (CE:ECHR:2018:1011JUD005521608).
(
6
)	Kingdom of Belgium, Kingdom of Denmark, Ireland, Hellenic Republic, Republic of Malta, Portuguese Republic and Kingdom of Sweden.
(
7
)	Judgment 6/2018, (VI. 27.).
(
8
)	CE:ECHR:2020:0716JUD004088817.
(
9
)	Magyar Közlöny 2017/30.
(
10
)	Which provides that Member States shall issue a residence permit to beneficiaries of refugee status.
(
11
)	According to which Member States shall issue travel documents for the purpose of travel outside of their territory to beneficiaries of refugee status.
(
12
)	Directive 2011/95/EU of the European Parliament and of the Council of 13 December 2011 on standards for the qualification of third-country nationals or stateless persons as beneficiaries of international protection, for a uniform status for refugees or for persons eligible for subsidiary protection, and for the content of the protection granted (recast) (OJ 2011 L 337, p. 9).
(
13
)	See, in particular, judgments of 16 July 2020, Rana v. Hungary, CE:ECHR:2020:0716JUD004088817 and of 22 June 2023, R.K. v. Hungary, CE:ECHR:2023:0622JUD005400620.
(
14
)	Judgment of 8 June 2017, Freitag (C‑541/15, EU:C:2017:432) (‘the Freitag judgment’).
(
15
)	See, by analogy, judgment of 17 February 2022, Y v. Poland, CE:ECHR:2022:0217JUD007413114.
(
16
)	Judgment of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994) (‘the Nowak judgment’).
(
17
)	See, in particular, judgment of 11 July 2002, Christine
Goodwin
v. the United Kingdom, CE:ECHR:2002:0711JUD002895795, §§ 86 to 93.
(
18
)	Judgments of 15 September 2011, Unió de Pagesos de Catalunya (C‑197/10, EU:C:2011:590, paragraphs 16 to 18) and of 26 September 2019, UTEP 2006. (C‑600/18, EU:C:2019:784, paragraph 17).
(
19
)	The file the referring court forwarded to the Court of Justice contains the documents and the evidence submitted in the course of the asylum procedure which refer extensively to the applicant’s transgender identity. Although the decision to recognise the applicant’s refugee status does not identify the precise grounds upon which it was based, subject to verification by the referring court, it appears that the applicant was granted refugee status due to acts of persecution based on their transgender identity. See, by analogy, Article 10(1)(d) of Directive 2011/95.
(
20
)	See the text of the first question.
(
21
)	See judgment of 16 December 1981, Foglia (244/80, EU:C:1981:302, paragraphs 18 and 19).
(
22
)	At the hearing, the applicant’s representative stated that the application to change name is incidental to that to change gender. The Hungarian Government’s written observations contend that a name change is not incidental to a change of gender. In his Opinion in Asociaţia Accept and Others (C‑4/23, EU:C:2024:385 points 59 to 64), Advocate General Richard de la Tour opined that recognition of a change of first name may be dissociated from recognition of change of gender, ‘even though the first name would appear to be linked to a different gender to that sociologically associated with the sex registered at birth’.
(
23
)	It is difficult to apply the Freitag judgment to the circumstances of the present case by analogy. That judgment concerned the fundamental right of EU citizens to move and reside freely within the territory of the Member States pursuant to Article 21 TFEU. As appears from point 18 of the present Opinion, the referring court expressly excluded the relevance of the applicant’s EU citizenship to the dispute pending before it. Nor does this case appear to contain any cross-border element. In the absence of any debate on the point, I advise the Court that it is not in a position to rule thereon. See also Opinion of Advocate General Richard de la Tour in Asociaţia Accept and Others (C‑4/23, EU:C:2024:385, points 40, 89 and 90), and judgment of 14 December 2021, Stolichna obshtina, rayon Pancharevo (C‑490/20, EU:C:2021:1008, paragraph 42 and the case-law cited), which emphasise the relevance of EU citizenship in comparable contexts.
(
24
)	Judgment of 5 June 2023, Commission v Poland (Independence and private life of judges) (C‑204/21, EU:C:2023:442, paragraph 332).
(
25
)	Judgment of 2 March 2023, Norra Stockholm Bygg (C‑268/21, EU:C:2023:145, paragraph 26 and the case-law cited). Article 2(3) of the GDPR contains a further exception on the processing of personal data by the Union institutions, bodies, offices and agencies. Article 2(2) of the GDPR is interpreted strictly: see judgment of 16 July 2020, Facebook Ireland and Schrems (C‑311/18, EU:C:2020:559, paragraph 84 and the case-law cited).
(
26
)	Judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF (C‑487/21, EU:C:2023:369, paragraph 23).
(
27
)	See, by analogy, judgment of 17 July 2014, YS and Others (C‑141/12 and C‑372/12, EU:C:2014:2081, paragraph 38 and the case-law cited).
(
28
)	An initially lawful processing of accurate data may, over time, become incompatible with the GDPR where the data appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes in the light of the time that has elapsed. Judgment of 24 September 2019, GC and Others(De-referencing of sensitive data) (C‑136/17, EU:C:2019:773, paragraph 74 and the case-law cited).
(
29
)	Judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network) (C‑252/21, EU:C:2023:537, paragraph 90 and the case-law cited).
(
30
)	Judgment of 5 June 2023, Commission v Poland (Independence and private life of judges) (C‑204/21, EU:C:2023:442, paragraphs 335 to 337).
(
31
)	The processing of the applicant’s data and the inclusion of their gender in the asylum register does not appear to fall within the special categories of personal data prohibited pursuant to Article 9(1) of the GDPR. Data on a person’s gender are not, in my view, to be equated with ‘genetic data’ or ‘data concerning a natural person’s sex life or sexual orientation’.
(
32
)	See, to that effect, judgment of 12 January 2023, Österreichische Post (Information regarding the recipients of personal data) (C‑154/21, EU:C:2023:3, paragraph 44).
(
33
)	Article 79(1) of the GDPR provides that, without prejudice to any available administrative or non-judicial remedy, a data subject concerned by a personal data processing operation has the right to an effective judicial remedy where he or she considers that his or her rights under that regulation have been infringed as a result of the processing of those data in breach of that regulation.
(
34
)	See, by analogy, the Nowak judgment, paragraph 53. The accuracy of data is assessed on a case-by-case basis taking account of all relevant circumstances.
(
35
)	See Paragraph 81(c) of the Asylum law.
(
36
)	See Paragraph 82(f) of the Asylum law.
(
37
)	The incongruity between the grounds for recognising the applicant’s refugee status and the entry of their gender as ‘female’ in the asylum register also conflicts with the right to good administration. While Article 41(1) of the Charter does not address itself to the Member States, the right to good administration, enshrined in that provision, reflects a general principle of EU law that the Member States must respect when they implement EU law, including Directive 2011/95. Judgment of 10 February 2022, Bezirkshauptmannschaft Hartberg-Fürstenfeld (Limitation period) (C‑219/20, EU:C:2022:89, paragraphs 36 and 37).
(
38
)	See recital 10 of the GDPR.
(
39
)	The use of the word ‘adapt’ in Article 6(2) of the GDPR discloses that the objective of that provision is to allow Member States to maintain or to introduce specific provisions on the processing of personal data in the performance of tasks carried out in the public interest or in the exercise of official authority. It therefore cannot operate so as to limit the effet utile of the rights and obligations laid down elsewhere in that regulation: see recital 10 of the GDPR.
(
40
)	Judgment of 20 October 2022, Koalitsia ‘Demokratichna Bulgaria – Obedinenie’ (C‑306/21, EU:C:2022:813, paragraph 50).
(
41
)	See, in particular, Article 21(1) of the GDPR, which refers to the right to object in the context of processing of personal data based on point (e) or (f) of Article 6(1) of that regulation. See also Article 13(1)(d) and (2)(b), Article 17(1)(b) and Article 20(1)(a) of the GDPR, which refer to specific points of Article 6(1) of the GDPR.
(
42
)	See recital 59 of the GDPR which states that ‘modalities should be provided for facilitating the exercise of the data subject’s rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests’.
(
43
)	See, by analogy, judgment of 21 June 2022, Ligue des droits humains (C‑817/19, EU:C:2022:491, paragraph 112) in which the Court recalled that the fundamental rights enshrined in Articles 7 and 8 of the Charter are not absolute, but must be considered in relation to their function in society.
(
44
)	See Opinion of Advocate General Bobek in J & S Service (C‑620/19, EU:C:2020:649, point 130) on the ‘open-ended wording’ of Article 23(1)(e) of the GDPR. While restrictions must be interpreted narrowly, the use of the term ‘in particular’ in Article 23(1)(e) of the GDPR does not limit that provision to the matters described therein but includes ‘other important objectives of general public interest of the Union or of a Member State’. On the strict interpretation of restrictions pursuant to Article 23 of the GDPR, see judgment of 6 October 2020, La Quadrature du Net and Others (C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraph 210). See also paragraph 3 of the European Data Protection Board’s Guidelines 10/2020 on restrictions under Article 23 GDPR, Version 2.1. Adopted on 13 October 2021. https://www.edpb.europa.eu/system/files/2021-10/edpb_guidelines202010_on_art23_adopted_after_consultation_en.pdf.
(
45
)	By recital 73 of the GDPR ‘restrictions concerning specific principles and the rights of information, access to and rectification … of personal data, … may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard … the keeping of public registers kept for reasons of general public interest …. Those restrictions should be in accordance with the requirements set out in the Charter and in the [ECHR]’.
(
46
)	This in effect reflects Article 52(1) of the Charter.
(
47
)	See, by analogy, judgment of 31 January 2023, Y
v. France, (CE:ECHR:2023:0131JUD007688817, § 89).
(
48
)	Subject to verification by the referring court.
(
49
)	See, by analogy, judgment of 14 December 2023, Natsionalna agentsia za prihodite (C‑340/21, EU:C:2023:986, paragraph 60).
(
50
)	See, by analogy, judgment of 8 December 2022, Google (De-referencing of allegedly inaccurate content) (C‑460/20, EU:C:2022:962, paragraph 68).
(
51
)	It would appear from the file that the referring court submitted that it has substantial evidence on the basis of which it may establish the inaccuracy of the entry in the asylum register pertaining to the applicant’s gender.
(
52
)	See judgment of 6 April 2017, A.P., Garçon and Nicot
v. France, (CE:ECHR:2017:0406JUD007988512 § 131). See also judgment of 19 January 2019, X and Y
v. Romania, (CE:ECHR:2021:0119JUD000214516 § 165). The judgments of the ECtHR are not binding on the Court as the EU has not acceded to the ECHR. Under Article 52(3) of the Charter, the Court must ensure that its interpretation of Articles 3(1) and Article 7 thereof affords a level of protection that does not fall below that which Articles 3 and 8 of the ECHR, as interpreted by the ECtHR, has established. See, by analogy, judgment of 6 October 2021, W.Ż. (Chamber of Extraordinary Control and Public Affairs of the Supreme Court – Appointment) (C‑487/19, EU:C:2021:798, paragraph 123 and the case‑law cited). The standard set by the ECtHR in, inter alia, its final judgment of 6 April 2017, A.P., Garçon and Nicot
v. France, (CE:ECHR:2017:0406JUD007988512) is, therefore, relevant to the proceedings before the referring court.
(
53
)	See, by analogy, judgment of 8 December 2022, Google (De-referencing of allegedly inaccurate content) (C‑460/20, EU:C:2022:962, paragraph 68).