On March 13, 2025, the Court of Justice of the EU (“CJEU”) ruled that the right of rectification (in Article 16 GDPR) requires a national authority to correct a person’s gender identity, where it is shown to be inaccurate (Case C‑247/23 [Deldits]).  The authority, however, may require that person to provide relevant and sufficient evidence to establish that the information concerning their gender is inaccurate, but may not go so far as to require proof of gender reassignment surgery.

The case concerns a refugee’s request that the Hungarian asylum authority change the refugee’s gender identity in the national registry.  The refugee had been born female, but identified as “male.”  The authority refused to change the individual’s gender identity until it had received evidence that the refugee had undergone gender reassignment surgery.  The authority considered the medical certificates supplied by the refugee from specialists in psychiatry and gynecology attesting to the refugee’s transgender identity as insufficient.

The CJEU ruled that if the authority’s purpose in collecting this information is to identify the refugee, then the authority should refer to the refugee’s “lived gender identity and not the identity assigned to them at birth.”  By failing to do so, the register contains inaccurate personal data that the authority should correct.  The CJEU also ruled that an EU Member State cannot limit the right to rectification based on the absence of a procedure for legal recognition of transgender identity in its national law to limit the right to rectification.  This EU right is enshrined in Article 8(2) of the Charter of Fundamental Rights of the EU and specifically expressed in Article 16 of the GDPR.  The CJEU went on to hold that national legislation preventing transgender persons from being entitled to the right to rectification is, “in principle, incompatible with EU law”.

With regard to the evidence that the refugee must provide to prove that their gender status is incorrectly assigned, the CJEU held that the authority may require the refugee to provide “such relevant and sufficient evidence as may reasonably be required.” However, the court emphasized, based on case law of the European Court of Human Rights, that “a Member State may not under any circumstances, by way of administrative practice, make the exercise of this right conditional upon the production of evidence of gender reassignment surgery.”

*          *          *

Covington’s Data Privacy and Cybersecurity Practice monitors CJEU cases closely and reports on relevant Court decisions and Advocate General opinions.  If you have any questions about the interaction between data protection and local laws, we are happy to assist.