Clash between gender data vs Hungarian personal data register: Can an existing Hungarian registry system prevent the enforcement of trans rights based on the GDPR?

 

Attila Szabó, PhD

Head of Legal Aid Service, Hungarian Civil Liberties Union

 

*The author assisted the lawyer representing the person concerned as an advisor in the Hungarian case analyzed in the text.  The author also used artificial intelligence to prepare the English version of the text.

 

Photo credit: Jorge Franganillo, via Wikimedia commons

 

In recent years, the Court of Justice of the European Union has increasingly engaged with trans rights. European constitutional community has followed this development. 

It appears that despite the consolidation of a GDPR interpretation aligned with trans rights, and thus with human dignity, Hungarian courts fail to understand that gender identity is not only a matter of self-determination, but also one of data accuracy. If someone presents and lives as a woman, then from the perspective of data accuracy she must also be treated as a woman, since this is the accurate data. The highest Hungarian court, however, sees this differently, and with its decision on the matter, it violates EU law.

Between 2024 and 2025, the Court of Justice of the European Union (CJEU) reshaped the landscape of trans rights in the EU through a remarkable line of cases: Mirin, Mousse, Deldits and Shipov. Taken together, these rulings reveal a structural shift in the CJEU’s approach. The Court increasingly speaks the language of “gender identity” rather than “gender reassignment,” signalling a move away from medicalised understandings of trans status and opening space for non-binary recognition. It integrates ECtHR standards as a constitutional floor while embedding trans rights across multiple doctrinal pillars: EU citizenship, free movement, privacy, equality, and data protection. What emerges is not a single breakthrough, but a coherent jurisprudential arc. One that justifies speaking of a significant doctrinal shift of trans rights in EU law.

Summary of the Hungarian Kúria’s Decision 

The claimant requested the rectification of the “sex” entry in the Hungarian personal data and address register from “male” (as recorded in the civil registry at birth) to “female,” relying primarily on Article 16 GDPR (right to rectification) and explicitly invoking the CJEU’s judgment in Deldits. The claimant argued that the register in question records “sex”, not “sex at birth,” and therefore should reflect lived (social) gender identity. Since her appearance and social relations objectively correspond to a female identity, the currently recorded data were inaccurate within the meaning of Article 5 (1) d) and Article 16 of GDPR. She maintained that the data protection authority should assess whether the recorded data correspond to reality as experienced and perceived, and that EU law requires rectification even if domestic civil registry law remains unchanged.

Both the first-instance court and, on review, the Kúria (Hungarian Supreme Court) rejected the claim. (The decisions have not yet been made public; this blog post provides the first summary of them.) The decisive reasoning was structural: the personal data and address register is a secondary, derivative register whose “sex” entry is based directly on the birth registry. Under Hungarian law, the birth registry records “sex at birth,” defined biologically. Since the personal data register derives this data from the civil registry, it cannot diverge from it without undermining legal certainty and the authenticity of public registers. The Kúria held that the register does not record “lived gender identity” at all; therefore, the data cannot be considered inaccurate merely because the claimant’s current gender identity differs from the birth record. In its reading of Deldits, the GDPR right to rectification applies only to data that are inaccurate within the meaning and function of the specific register concerned. Article 16 GDPR cannot be interpreted as obliging an authority to insert new categories of data (e.g. lived gender identity) without explicit statutory authorisation, nor to assign a different substantive meaning to an existing category (“sex at birth”). The Court therefore concluded that no inaccuracy existed and that rectification was not required.

Mistakes in the decision

The conceptual distinction between “sex at birth” and “sex” undermines the exclusivity claim. The birth registry records a historical biological fact at the time of birth. By contrast, the personal data and address register functions as an operational identification database used for everyday legal and administrative interactions. Accuracy in this context serves identification and legal certainty in present-day relations. If the data recorded there do not reflect the individual’s lived and socially recognised gender, they may fail the accuracy requirement precisely because they hinder reliable identification. The fact that one dataset originates historically from another does not transform the original entry into an immutable legal truth for all future processing contexts.

Secondly, Hungarian law itself does not establish that the civil registry is the sole permissible source of “sex” data in all registers. If it would have been so it would be absolutely unchangeable. However it is not, since the statutory framework governing the personal data and address register allows updates based on legally valid rectification requests. It is fully in line with GDPR. Moreover, even Hungarian constitutional jurisprudence has recognised that legal acknowledgment of gender identity, at least outside the civil registry context, may be compatible with the Hungarian Fundamental Law. This demonstrates that the legal system does not treat the birth entry as metaphysically definitive, but as one administrative record among others.

Finally, the “hierarchy of registers” argument reverses the logic of legal certainty. Legal certainty is not preserved by maintaining inter-database consistency at the price of factual inaccuracy. Rather, certainty requires that state records correspond to verifiable social and legal reality. If necessary, consistency between registers can be achieved by differentiating between “sex at birth” (retained in the birth registry) and current “sex” or gender identity (reflected in identification databases). EU law does not require uniformity of terminology across all databases; it requires accuracy, proportionality, and effective protection of fundamental rights. Therefore, the proposition that only the birth registry may serve as the lawful source of sex-related data is neither compelled by domestic law nor compatible with the GDPR as interpreted by the Court of Justice.

The Decision in the Context of European Law

This ruling stands in notable tension with the emerging CJEU jurisprudence represented by the Deldits, Mirin, Mousse and Shipov cases. In Deldits, the CJEU held that where a register contains personal data relating to gender identity, that data must be rectified if inaccurate, and that Member States may not impose disproportionate evidentiary burdens (such as proof of surgery). The Hungarian Kúria distinguished Deldits on the basis that the asylum register there functioned as a primary identity register, whereas the Hungarian personal data register merely mirrors the civil registry’s birth-sex entry. The core of Kúria's reasoning is therefore ontological: if a register is designed to record biological sex at birth, then a divergence from lived gender identity does not render it “inaccurate.”

This is, of course, a misconception: the personal data register, which is distinct from the civil (birth) registry, exists precisely to record the data necessary for identification. In most cases, those data derive from the civil registry; however, in the case of trans persons, they do not necessarily follow from the birth registry but from factual circumstances that, through a rectification procedure, could also become officially documented facts. This state database can record birth sex data and accurate, actual data too, in parallel. Kúria argues that the registry only processes data relating to "sex" and cannot process data relating to birth gender and current gender without a change in legislation. This is true, of course, but the data controller can, in such cases, process only data relating to current gender in the registry that exists alongside the birth registry system.

Nor is Kúria's argument persuasive that it cannot order the processing of “new” data. The personal data register can, within the existing legal framework, be modified technically and administratively if in its current form it does not comply with the requirements flowing from the GDPR and EU law. The Kúria therefore did not give effect to EU law, but rather to domestic practical constraints: it effectively treated a functional system as if it were a legal norm, even though in reality such a system should adapt to legal norms, not prevent their enforcement.

From an EU law perspective, however, this formalistic register-based distinction raises deeper questions. The recent CJEU trend has emphasised substance over classification: Mirin prioritised the practical effectiveness of EU citizenship and identity coherence across registers; Mousse treated gender-related data as protected personal data subject to strict necessity and proportionality review; and Deldits framed gender identity as a legally relevant dimension of accuracy under the GDPR. Against this background, the Hungarian decision represents a restrictive reading of Article 16 GDPR, confining rectification to internal consistency within a nationally defined registry hierarchy.

In this case, we will still turn to the Hungarian Constitutional Court. However, if that body also fails to restore the possibility of effective legal enforcement under the Hungarian Fundamental Law and the binding EU law applicable on that basis, then, besides applying to the European Court of Human Rights, the only remaining option will be for the European Commission to initiate infringement proceedings and thereby compel Hungary to comply with the binding requirements of the GDPR and the Charter of Fundamental Rights. And yes, if necessary, let them add another field to the personal data register system.

Following the very recent Shipov decision, the situation is even clearer: the position of the Hungarian Supreme Court is completely untenable. In that case, the court ruled that it violates the right to free movement if a person is unable to identify themselves in another Member State with an identity document corresponding to their true gender. The current Hungarian case highlights that this violates not only the right to free movement but also the GDPR’s data accuracy rules. After all, inaccuracy is not only a problem when someone travels to another Member State. The two cases are thus based on different legal arguments, but they point to the same thing: inaccuracy causes privacy difficulties that violate the right to private life protected by the Charter of Fundamental Rights.

 

 

 

Mutual trust does not supersede human rights! Italian judges unprecedently recognize the refugee status to an EU citizen

 

Dr. Chiara Scissa*

Photo credit: Bologna Tribunal, photo by Alex Sirac via Wikimedia Commons

* Research fellow in EU law at the University of Bologna – Alma Mater Studiorum. This contribution is part of the ERC 2022-TSG research project "Gatekeepers to International Refugee Law? - The Role of Courts in Shaping Access to Asylum" (ACCESS). Grant Agreement No. 101078683.

1. On 10 October 2025, the Tribunal of Bologna – Specialized Section on Immigration, International Protection and Free Movement of EU Citizens issued a decree of great importance for the right to asylum as conceived in EU law. For the first time, Italian judges have found that an application for international protection by a citizen of another EU Member State is admissible, granting her refugee status. In the present case, therefore, the presumption between the EU Member States to consider each other as safe countries of origin for all legal and practical purposes related to asylum issues (which in many cases is automatic, see for example here and here for the practice in Ireland, Austria, the Czech Republic, and Hungary) is dropped.

2. With decree r.g. 8445/2023, the Tribunal of Bologna pronounced on a proceeding brought by a Hungarian applicant against the rejection of her international protection claim, notified to her by the Territorial Commission for the Recognition of International Protection of Verona – Vicenza Section (first-instance administrative authority), as inadmissible. Inadmissibility was based on two considerations.

First, Protocol 24 to the Treaty on the Functioning of the European Union (TFEU) on asylum for citizens of EU Member States enshrines that asylum claims by EU citizens must be considered, apart from exceptional cases, inadmissible by virtue of the level of protection of the fundamental rights and freedoms guaranteed to them by the Treaties,  including those enshrined in the European Convention on Human Rights (ECHR), whose rights form part of EU law as general principles. According to the above-mentioned Protocol, an asylum application lodged by a European citizen may be examined or declared admissible only if: a) the Member State of which the applicant is a national proceeds after the entry into force of the Treaty of Amsterdam, availing itself of the provisions of Article 15 ECHR, to take measures derogating in its territory from its obligations under that Convention; b) the procedure referred to Article 7(1) of the Treaty on European Union (TEU) has been initiated and until the Council, or, where appropriate, the European Council, takes a decision in respect thereof with regard to the Member State of which the applicant is a national; c) the Council has adopted a decision in accordance with Article 7(1) TEU in respect of the Member State of which the applicant is a national or if the European Council has adopted a decision in accordance with Article 7(2) TEU in respect of the Member State of which the applicant is a national; d) a Member State should so decide unilaterally in respect of the application of a national of another Member State; in that case the Council shall be immediately informed; the application shall be dealt with on the basis of the presumption that it is manifestly unfounded without affecting in any way, whatever the cases may be, the decision-making power of the Member State.

Second, given the existence of conflicting opinions on the applicability of the above exceptions to the case at hand, the Territorial Commission had requested an opinion from the National Commission on the possibility that the proceedings initiated against Hungary pursuant to Art. 7.1 TEU (so-called suspension clause) could fall within the hypothesis referred to in paragraph b). The National Commission, taking note of the absence of an express position endorsed by the Council on the applicability of art. 7.1 TEU to Hungary, concludes that the application should be considered as inadmissible. In the appeal, the defence argues that the applicant is primarily entitled to asylum on the basis of paragraph (b) of Protocol 24 or on the ground of the safeguard clause referred to in point (d), according to which a Member State may decide unilaterally to declare admissible the asylum application lodged by a national of another Member State.

3. To begin with, the Court verified the admissibility of the application for international protection in the present case by assessing whether the initiation of the procedure pursuant to Article 7.1 TEU against Hungary may have fallen within the situations referred to in paragraph b) of Protocol 24 cited above. Article 7 TEU provides for the possibility of suspending certain rights deriving from EU membership in the presence of a serious and persistent violation of the values referred to in Art. 2 TEU (respect for human dignity, freedom, democracy, equality, rule of law and respect for fundamental rights, including the rights of persons belonging to minorities). The rule provides for a two-step procedure. It provides that, on the proposal of one third of EU Member States, or of the European Parliament or of the European Commission, the Council, acting by a majority of four fifths of its members, having obtained the Parliament’s consent, may determine that there is a clear risk of a serious breach of these fundamental principles by a Member State, and address appropriate recommendations to it. Article 7(2) and (3) TEU then provides that, if the infringement is found, the Council, acting by a qualified majority, may decide to suspend some of the rights that derive from application of the Treaties to the Member State in question.

Since its creation in 1999 by the Treaty of Amsterdam until today, the so-called suspension clause has only been initiated twice. In 2017, the European Commission launched the procedure against Poland, but the Commission later withdrew its reasoned proposal in 2024, effectively concluding the procedure. In September 2018, the European Parliament then adopted a Resolution with which it initiated the procedure against Hungary. Despite various discussions and hearings, the latter procedure is still ongoing.

4. Although neither the Council nor the European Council has ever expressed a position on this point, it is clear that the adoption of a reasoned proposal by the European Parliament in this field is an integral part of the procedure laid down in Article 7 TEU, in opposition to the findings of the first-instance administrative authorities. In support of this, in the context of the action for annulment pursuant to Article 263 TFEU filed by Hungary against this Resolution, the Court of Justice of the EU (CJEU) clarified beyond any doubt that “[...] the adoption of the contested resolution initiates the procedure laid down in Article 7(1) TEU. Under point (b) of the sole article of Protocol (No 24), once that procedure is initiated and as long as the Council or the European Council has not taken a decision in respect of the Member State concerned, a Member State may, by way of derogation from the general rule laid down in that single article, take into consideration or declare admissible to be examined any asylum application lodged by a national of the Member State that is the subject of that procedure” (CJEU,  Hungary v. European Parliament, 2021, para. 41).

According to the Tribunal of Bologna, the CJEU's ruling ascertains that the principle of mutual trust, which permeates both the area of freedom, security and justice and the asylum policy “[...] is not a ‘blind trust’ and cannot be taken for granted” (p. 5), as has already been pointed out in the context of the application of the Dublin Regulation both by the CJEU (e.g., in N.S. and M.E., 2011; Abdullahi, 2013) and by the ECtHR (MSS v. Belgium and Greece, 2011).

5. The clear risk of serious and persistent violations of the foundational values of the EU imputed by the European Parliament against Hungary concerned, in particular, the respect for the rights of minorities in the country, including Roma and people with different SOGIESC (Sexual Orientation, Gender Identity, Gender Expression, and Sex Characteristics). In its 2018 Resolution and in the following ones (2022, 2023, 2024a, 2024b), the European Parliament denounced the widespread climate of violence against minorities in Hungary; the systematic discrimination and exclusion of Roma people with regards to the rights to housing, education, employment, health care and participation in social and political life; the widespread discrimination and xenophobia against people with different SOGIESC whose right to legal recognition and self-determination is denied by current legislation.

6. In view of the fact that the applicant**, who is a Hungarian national of Roma ethnicity, defines herself as transgender, and having verified the serious violations of human rights against those communities in Hungary, the Court finds that the application for international protection is admissible under paragraph (b) of Protocol 24 TFEU and carries out an assessment of the present case. The Court considers the applicant's predicament to be credible. In particular, the judges report that she was registered as a male, which is incongruent with her gender identity, and that she has suffered continuous violence and discrimination since school because of her ethnicity and gender. The applicant reports aggressions and abuses perpetrated both by society and by her family members, who wanted to force her into marriage with a woman denying her gender identity and her transition path. She has decided to leave her country following that episode. She also states that she was unable to correct her personal data by reassigning her registered sex at birth in Hungary because that was prohibited by law.

The Court also takes into account the psychological reports concerning the applicant, which certify traumas and experiences of stigmatization that led her to have suicidal thoughts. The predicament is coherent with the country of origin information collected by the Tribunal about the widespread discrimination in Hungary against both the Roma community and people with diverse SOGIESC, fueled both by society and through law. The Court therefore recognizes that “[...] for transsexual people, the failure to recognize gender reassignment leads to a serious violation of the right to personal identity (with significant repercussions on the rights to work, marriage, family and freedom of movement itself) which is not merely discriminatory, but persecutory, since it forces the person to live [...] with a formal identity different from [...] what he or she actually is” (p. 13). The Court therefore recognises the refugee status to the Hungarian applicant on the ground that she belongs to a particular social group (that of people with diverse SOGIESC and of Roma ethnic minority).

7. The judgment of the Tribunal of Bologna, in addition to being unique in Italy, allows us to draw some broader reflections on EU asylum law. First of all, it contributes to better delineating the purpose ratione personae of international protection, reducing – albeit slightly – the gap that separates it from the scope of refugee protection under the 1951 Geneva Convention. Although, unlike its international counterpart, international protection as conceived in EU law does not normally apply to EU citizens, this does not mean that this exclusion is to be considered automatic or even absolute pursuant to the specific clauses explicitly provided for in Protocol 24 annexed to the TFEU, in addition to the general discretion of each Member State to assess any asylum application by citizens of other Member States (letter d)).

From the point of view of cooperation between Member States, this decree is part of a path already traced by the highest European Courts, which clarify that the principle of mutual trust in the field of asylum is not “unconditional” and can only exist if fundamental rights are effectively respected. The fact that other Member States have already granted forms of protection to EU citizens in the last decade and that, according to Eurostat data, more than 1900 EU nationals - mainly from Hungary, Poland, Romania and Bulgaria - applied for asylum in other Member States between 2020 and 2024 corroborates that the presumption of mutual trust is not monolithic.

In the face of the serious violations of human rights and the rule of law existing in Hungary that infringe the set of values on which the Union is based (Article 2 TEU) and that are pushing its own citizens to seek refuge in other Member States, these are consequently called upon to verify the admissibility of international protection claims by Hungarian citizens not only until EU institutions have ruled on the suspension clause, but also by acting unilaterally to protect fundamental human rights.

** The pronouns and terms used to refer to the applicant are the ones used by the Tribunal of Bologna in its ruling and do not necessarily reflect the opinion of the author.