ava's blog

fighting for trans rights with data protection law

I'm a part time law student with a personal focus on data protection law and am separately starting a certificate class in April to officially become a data protection officer. So I was mega excited to read this article by We Are Queer Af today titled "A trans refugee's court case against Hungary just improved Trans+ rights across all of Europe".

Focus of the article is an Iranian trans man who sought refuge in Hungary in 2014 and was granted asylum. He would only be granted citizenship under the wrong gender in the asylum registry, and because Hungary had banned legal gender recognition in 2020, it would not be possible to change it in the future. He tried to get name and gender amended in the asylum register by offering up documentation around his transition, but the Hungarian authority denied the request because he had not undergone surgery and said the documents would only prove he has a transgender identity, not that he is male. He brought this to Hungary's Budapest High Court.

Last Thursday, the Court of Justice of the European Union ruled that under Articles 16 and 5(1)(d) of the General Data Protection Regulation that Hungary must correct inaccurate personal data concerning gender identity held in public registers without undue delay in the case Deldits (C-247/23). Not only that, but it also ruled that the accuracy of that data couldn't be based on whether people have had surgical gender-affirming care, because the case law of the European Court of Human Rights shows that gender reassignment surgery cannot be required for the purposes of recognising a change of gender identity.

This is important because it extends your GDPR rights, especially the right of rectification, to gender identity. It's easy to think of data protection as something technical only, something to keep Silicon Valley in check, but it means so much more. You can hold institutions accountable to use the correct name and gender with it, too.

Naturally I was interested in the actual case files, which can be found here, just select your preferred language.

interesting bits that stood out to me

The core questions of the trial were on how Art. 16 GDPR should be interpreted:

The Court concluded that according to the existing case law, the assessment of whether personal data is accurate and complete must be made in the light of the purpose for which those data were collected. The data was collected and processed for the purpose of identifying the data subject in regard to granting asylum. To accurately identify a person for these purposes, the Court agreed it would be more useful and accurate to refer to that person’s lived gender identity, and not to the identity assigned to them at birth. Which makes sense - if you maintain that register and let's say, revoke the permission of asylum and need to seek that person out for deportation, it doesn't help to have a wrong name and gender on the document and the person you're seeking has a different name and looks completely different.

At its core, the GDPR and it's intention is about ensuring a high level of protection of fundamental rights and freedoms of natural persons, mostly their right to privacy about their personal data, as set in Article 8(1) of the Charter and Article 16(1) TFEU as well as a lot of case law. This is important, because gender identity is personal data because it relates to an identified or identifiable natural person especially in this asylum register together with every other piece of data relating to the man, and this data was processed - so there should ideally be no question about the application of the GDPR. It is also underrated that there is a need of privacy around transitioning and deadnames, which the GDPR should reasonably deal with and respect as well.

A critical point is that the GDPR has opening clauses, where the member states can, within the limits outlined in the respective article(s), set their own national rules. They're not that many, but the right to rectification set out in Art. 16 can be restricted with the conditions of Art. 23, which lets a member state impose restrictions on personal data set out in public registers kept for reasons of general public interest or safety. An asylum registry is such a register. Restrictions by national legislature on personal data in the form of a public asylum register might be for reasons of general public interest, in particular in order to ensure the reliability and consistency of those registers. The Hungarian legislation so far doesn't have a restriction like that, but there is I guess nothing stopping them from doing that in the future. Because even in the case file, the Court mentions there was no national restriction set by Hungary and they didn't justify their refusal on one, either, but on insisting that the man had not provided proof of his gender identity.

One good thing in this particular asylum case is the interpretation that even if there had been national legislation, it would not have helped Hungary here. National legislation which prevents a trans person whose gender isn't recognized from fulfilling a requirement needed to be entitled to a right protected by EU law (such as asylum) is regarded as being incompatible with EU law. So the way I see this is that a national legislation in Hungary setting boundaries for Art. 16's personal data in a way to not recognize trans people's gender is still possible, but wouldn't hold up as long as it prevents their access to resources and rights, and the right to rectification is such a right. I wonder if Hungary will pass such a legislation anyway for other purposes.

Moving on to the second and third question, Art. 16 doesn't further specify which evidence may be required to verify the inaccuracy of the personal data which someone seeks to have rectified. Interestingly, they quickly mention the Google case here (De-referencing of allegedly inaccurate content), C‑460/20, EU:C:2022:962) to maintain that someone may be required to provide relevant and sufficient evidence which can reasonably be required and with respect to each case's circumstances. BUT! The administrative practice of Hungary requiring trans people to have had surgery to make use of their right to rectification based on Art. 16 without even having legislature for it is a national restriction, which must respect "the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society in order to safeguard certain objectives listed in that regulation, such as, inter alia, important objectives of general public interest of the European Union or of a Member State." That's simply not the case with requiring surgery, as it's not even in line with the Charter Articles 3 and 7.

This is beautiful:

"[...]Article 7 of the Charter protects a person’s gender identity, which is a constituent element and one of the most intimate aspects of their private life. Thus, that provision encompasses the right to establish details of their identity as individual human beings, which includes the right of transgender people to personal development and physical and moral integrity and to respect for and recognition of their gender identity. To that end, Article 8 imposes positive obligations on States, in addition to negative obligations to protect transgender persons against arbitrary interference by public authorities, which also entails the establishment of effective and accessible procedures guaranteeing effective respect for their right to gender identity. Furthermore, in view of the particular importance of that right, States have only limited discretion in this area."

Because of this and the existing ECHR base that recognition of the gender identity of a transgender person cannot be made conditional on the completion of surgery, none of it is necessary or proportionate to ensure reliability and consistency of a public asylum register and medical certificates are enough. To be honest, it's still a shame it needs medical certificates for that, but still.

It's great to see this because I thought about writing a post on whether the GDPR could be used in place of the Selbstbestimmungsgesetz in Germany or not (not as legal advice, but exploring the legal avenues and arguments in my head), and this is motivating me to write about my passion more. I often feel held back by the fact that anything legal is seen as very serious and I don't want to give off the wrong impression, but I do miss sharing more about my special interest.

Reply via email
Published 18 Mar, 2025

#2025 #data protection