In the case of Alace and Canpelli (joined cases C-758/24 and C-759/24, 1.8.2025), the CJEU ruled on the application of the concept of “safe country of origin” and its consequences.

In the CJEU’s press release, the facts of this case are summarized as follows.

The case concerns two Bangladeshi nationals who were rescued at sea by the Italian authorities and taken to a detention centre in Albania under the Italy-Albania Protocol, which establishes a detention and repatriation centre on Albanian territory, but subject to Italian jurisdiction. Their application for international protection was examined under the accelerated border procedure by the Italian authorities, which rejected it as unfounded, on the ground that their country of origin is considered ‘safe’.

Under the Procedures Directive (2013/32), Member States may accelerate the examination of applications for international protection and conduct it at the border where those applications are made by nationals of countries considered to offer adequate protection. In Italy, that designation of third countries as safe countries of origin has been effected, since October 2024, by a legislative act. Under that act, Bangladesh is considered in Italy to be such a ‘safe country of origin’.

The applicants challenged the rejection decision before the Rome District Court, which made a reference to the CJEU in order to clarify the application of the safe country of origin concept and the Member States’ obligations in terms of effective judicial review.

*              *              *

The findings of the CJEU in this case can be summarized as follows:

• EU law allows Member States to designate third countries as safe countries of origin by legislation, but such designations must be open to effective judicial review, ensuring compliance with the material conditions in Annex I of the Directive.
• The sources underlying such designations must be sufficiently accessible to applicants and courts to guarantee effective protection of rights; national courts may also rely on their own reliable information, provided both parties can comment on it.
• Until Regulation 2024/1348 takes effect (expected 12 June 2026, unless advanced), Member States may not designate as safe any country that fails to meet the material conditions for certain categories of persons.

*              *              *

The main issue before the CJEU was about whether it makes any difference when the designation of a country as safe is the result of a legislative act. In essence, the CJEU’s response, based on an interpretation of Article 46 of the Procedures Directive, is that the legislative origin of this designation does not matter much: While there is no principled objection against such a designation being made through a legislative act, the effectiveness of the remedy nonetheless requires that the designation as safe country of origin, which has to comply with the criteria set out in Annex I to the Procedures Directive, must be open to judicial review in an individual case.

This in turn requires that the information on which the designation is based be made accessible both to the applicant and the competent judicial authority for adversarial comments. Since the designation as safe country is only a rebuttable presumption of adequate protection in the country of origin (§ 48), the reviewing court must carry out a full and ex nunc examination of both facts and points of law (§ 76). A question however arises as to the impact of the rebuttal of this presumption by a court in an individual case: is each reviewing court to have the power to rebut or not that presumption in an individual case? Might this give rise to a patchwork of approaches?

In any event, in light of the above requirements, an individual assessment which is open to judicial review is still required in cases which are decided on the basis of the safe country status. This would appear to significantly reduce the benefit to be expected from summary or accelerated procedures at the border or in transit zones.

*              *              *

The above approach is in line with the one followed by the ECtHR, as exemplified by the case of S.H. v. Malta (37241/21, 20.12.2022), which is a striking illustration of why an individual review may be called for in cases decided in light of the safe country status.

The case concerned a Bangladeshi journalist who fled his country after reporting on electoral irregularities in his country and claimed that he was therefore exposed to threats and attacks. ​ In Malta, he filed three successive applications for asylum which, according to the ECtHR, faced multiple significant procedural shortcomings, including:

• A lack of legal assistance
• A superficial credibility assessment
• The failure to consider relevant evidence
• A superficial and automatic judicial review, giving rise to stereotyped decisions given within 24 hours
• Delayed and ineffective notifications
• A lack of individualized risk assessment
• The ineffectiveness of the Constitutional redress proceedings, due the absence of an automatic suspensive effect pending these proceedings

As a result, the ECtHR ruled that returning S.H. to Bangladesh without a fresh assessment of the risks he might face back in his country of origin would violate Articles 3 (prohibition of ill-treatment) and 13 of the Convention (right to an effective remedy).

What makes S.H. v. Malta particularly relevant in the present context is the fact that S.H.’s application was processed in Malta, an EU Member State, under an accelerated procedure, with the authorities relying all along on the designation of Bangladesh as a safe country of origin.

The case also very well illustrates the interplay between EU law and the Convention in these matters. It is characterized by the ECtHR coming last in ruling on the merits of the case and assessing the use made by national authorities of the safe country of origin concept. In S.H. v. Malta, the ECtHR ordered a fresh assessment of the risks involved in returning the applicant, pending which the national authorities were requested, by way of an interim measure (Rule 39 of the Rules of Court), to stay the execution of the impugned deportation.

As the ECtHR put it: “while the Court need not enter into the ministerial decision designating Bangladesh as a safe country, … a full individual assessment is nonetheless called for in certain circumstances, despite such designation.” (§ 91) In D.L. v. Austria (34999/16, 7.12.2017), the ECtHR was even more explicit when stating: “the Court must agree with the applicant that as concerns his individual case, it was irrelevant whether Kosovo was declared a ‘safe country of origin’ by law. Such a declaration does not relieve the extraditing State from conducting an individual risk assessment.” (§ 59)

*              *              *

Fortunately, as regards the assessment to be carried out by national courts relying on the safe country of origin concept, the requirements set out by the CJEU largely coincide with those of the ECtHR. Both European Courts indeed insist on the effectiveness which should characterize the review to which the application of the safe country of origin concept must be subject (S.H. v. Malta, § 78; Alace and Canpelli, §§ 65, 78, 80, 86), the concept of safe country of origin being only a rebuttable presumption of adequate protection in the country of origin (Alace and Canpelli, § 48). This notably requires the review to have an automatic suspensive effect (S.H. v. Malta, § 79; Art. 46(5) of the Procedures Directive).

However, while Article 46 of the Procedures Directive only states the right of applicants for international protection to an effective remedy, the CJEU, by reading this provision in the light of Article 47 of the EU-Charter, requires this remedy to be judicial in nature (§ 77). By contrast, under the Convention, such a remedy does not need to be judicial, but it should allow an independent, rigorous and prompt scrutiny (§ 79). For both European Courts, the reviewing authority should carry out a full and ex nunc examination of both facts and points of law (Art. 46(3) of the Procedures Directive).

Both European Courts also seem on the same line in considering that adequate information of the applicants and the reviewing authorities is key in ensuring the effectiveness of any review. While the ECtHR in S.H. v. Malta criticises the lack of a proper reasoning of the decisions rejecting S.H.’s applications for asylum (§§ 86-87), the CJEU explains the link between proper information and effectiveness of the review as follows:

“In the light of the case-law cited in paragraph 78 above, it must, therefore, be held that, in order for the judicial protection to be effective, both the applicant concerned and the court or tribunal seised must be able to have not only knowledge of the grounds for such a rejection, but also access to the sources of information on the basis of which the third country in question was designated as a safe country of origin.” (§ 80)

In this context, the CJEU holds that the reviewing court must raise, on the basis of the information in the file and the information brought to its attention during the proceedings before it, a possible failure to have regard to the material conditions for the designation of a third country as a safe country of origin, set out in Annex I to that directive. That court may also do so by taking into account other information which it may itself have gathered, whether from public sources or from sources which it has requested one of the parties to the proceedings before it to produce (§§ 85-86).

The use of “may” suggests that gathering relevant information of its own motion is only an option for the reviewing court. However, this may not be enough under the Convention. In S.H. v. Malta the ECtHR indeed reiterated that in relation to asylum claims based on an individual risk, it must be for the person seeking asylum to rely on and to substantiate such a risk. However, if a Contracting State is made aware of facts relating to a specific individual that could expose him to a risk of ill-treatment in breach of the said provisions upon returning to the country in question, the obligations incumbent on the States Parties under Articles 2 and 3 of the Convention entail that the authorities carry out an assessment of that risk of their own motion (§ 88, with reference to F.G. v. Sweden).

*              *              *

What is now the bottom line of this comparison of the Luxembourg and Strasbourg jurisprudences?

As always, the courts of EU Member States should apply EU law without breaching the Convention, since compliance with the latter when applying EU law can be challenged by way of an application before the ECtHR. The required modus operandi can therefore be summarized as follows:

• The application of the safe country of origin concept does not relieve the extraditing State from conducting an individual risk assessment (common requirement);
• A third country which fails to meet the material conditions in Annex I of the Directive for certain categories of persons cannot be considered safe (Luxembourg requirement);
• This risk assessment must be open to rigorous scrutiny (Strasbourg requirement) within the framework of an effective judicial remedy (Luxembourg requirement), which requires a full and ex nunc examination of both facts and points of law (common requirement);
• This judicial remedy must have an automatic suspensive effect (common requirement);
• The reviewing courts and the applicants must be provided with adequate information of the grounds for a rejection of an application for international protection based on the safe country of origin concept (common requirement), and with access to the sources of information on the basis of which a third country in question was designated as a safe country of origin (Luxembourg requirement);
• The obligations incumbent on the States Parties under Articles 2 and 3 of the Convention entail that the authorities carry out an assessment of that risk of their own motion (Strasbourg requirement).

This post is titled: “How safe is the safe country or origin concept?” In light of cases such as S.H. v. Malta, it seems that the answer must be: less safe than one might expect.

After a series of inconsistencies in the case-law of the CJEU on the application of ne bis in idem to dual administrative – criminal proceedings, in addition to some discrepancies with the Strasbourg case-law on this topic (see Menci, bpost, BV and MV – 98), it is noteworthy that a certain stability seems to be now emerging in this area with the CJEU’s judgment in the case of Engie România SA (C-205/23, 30.1.2025).

Engie România SA, a natural gas supplier, was penalized by two Romanian authorities – the National Energy Sector Regulatory Authority (ANRE) and the National Consumer Protection Authority (ANPC) – for allegedly breaching transparency obligations and engaging in misleading commercial practices.

The applicant company was accused of failing to provide clear information to customers about its right to adjust the price of natural gas during a fixed 12-month contract period. ​The ANRE imposed fines totaling RON 800,000 (approx. ​ EUR 160,000) and required Engie to revert to the original contract price. ​ Separately, the ANPC imposed a fine of RON 150,000 (approx. ​ EUR 30,000) for misleading and aggressive practices.

The referring court, the Bucharest Regional Court, asked the CJEU inter alia whether the combination of these two penalties had infringed the ne bis in idem principle, laid down in Article 50 of the EU-Charter, which prohibits double criminal proceedings or punishment.

The CJEU’s answer to this question is very much in line with its bpost jurisprudence, which itself extensively relied on A and B v. Norway, the leading Strasbourg case on dual proceedings. While applying a methodology according to which the second set of proceedings is to be considered as a limitation the legality of which is to be checked under Article 52(1) of the EU-Charter, thus departing from the Strasbourg approach on this issue, the CJEU nonetheless applies criteria which are rather close to the Strasbourg criteria, with both European Courts considering that the decisive issue is whether the two set of proceedings can be considered as a “coherent whole”. This is notably so when the proceedings brought by two different authorities pursue complementary aims relating to different aspects of the same unlawful conduct (§ 63).

If this is indeed the case, according to the CJEU, imposing criminal penalties by two different authorities for the same facts is allowed under Article 50 of the EU-Charter, provided a) clear and precise rules exist to predict such duplication of proceedings and penalties, and ensure coordination between the two sets of proceedings, b) these proceedings are conducted in a coordinated and timely manner, and c) penalties are proportionate to the seriousness of the offenses and do not impose an excessive burden. ​

This judgment is to be welcomed as an important contribution to the internal stability of the Luxembourg case-law on dual criminal proceedings and to the harmony with the Strasbourg case-law on this issue.

In the case of Inspektorat kam Visshia sadeben savet (joined cases C-313/23, C-316/23, C-332/23, 30.4.2025), the CJEU addresses several legal questions concerning judicial independence and the application of the General Data Protection Regulation (GDPR) in Bulgaria.

The case involves the Bulgarian Inspectorate at the Supreme Judicial Council (“Inspectorate”), which requested the referring court, the Sofia District Court, to lift banking secrecy on the accounts of several judges, prosecutors, and their family members. ​ The purpose was to verify asset declarations submitted by these individuals, as required under Bulgarian law.

In its ruling, the CJEU first holds that the principle of judicial independence under Article 19(1) TEU and Article 47 of the Charter precludes a practice whereby members of a judicial body, here the Inspectorate, continue to perform their functions beyond their constitutionally defined terms of office without clear legal rules limiting such extensions.

However, this post will focus on the CJEU’s findings regarding the requirements of the GDPR in the present case, more particularly on the answer by the CJEU to the sixth question raised by the referring court: whether it should, when dealing with the lifting of the bank secrecy in this case, ensure of its own motion the protection of the security of the data of the persons concerned.

In the aftermath of Deldits, which already involved the European Convention on Human Rights in interpreting the GDPR, this case indeed presents significant considerations for further reflection on the Convention’s impact on the application of the GDPR.

*              *              *

In substance, the CJEU answers the referring court’s sixth question by stating that if it is not seized under Articles 78(1) or 79(1) of the GDPR, and in the absence of rules of Bulgarian law expressly conferring supervisory powers on it, it is not required to ensure compliance with the substantive provisions of the GDPR in order to ensure their effectiveness (§ 135). However, the effectiveness of the remedies under Articles 77(1), 78(1) and 79(1) of the GDPR is to be ensured at domestic level, as a requirement flowing from Article 47 of the EU-Charter (§ 136). In other words, only an ex post judicial review is required under the GDPR, not an ex ante review. From a Convention perspective, this reasoning calls for the following observations.

One of the particularities of the GDPR is indeed the fact that, along with the European Public Prosecutor’s Office and Frontex, it belongs to the category of recent legal constructions by the EU which associate national and EU entities in implementing EU law. The list of these entities operating in the context of the GDPR includes, as national entities, the controllers, the processors, the supervisory bodies and the national courts, and, as a “body of the Union” with legal personality, the European Data Protection Board (“the Board”) (Art. 68(1)). In addition, the activity of these entities is governed by a combination of EU and national regulations (Recital 10, Art. 6 (2) and (3), Art. 58(6)).

The integration of EU and national entities, governed by both EU and national regulations, raises important questions regarding the standards which these entities must apply concerning the fundamental rights of individuals whose data come within the scope of the GDPR.

The protection of these fundamental rights indeed seems a major concerns of the drafters of the GDPR. However, despite some general statements to this effect (e.g. in Recitals 4 and 73), the GDPR itself provides limited guidance on how this concern should translate into the practical application of GDPR provisions. The following considerations may offer some help in this respect.  

First, in the framework of the GDPR, the ultimate control over respect of a data subject’s rights, including his or her fundamental rights, lies in the hands of the national courts, which are entrusted with the competence to review legally binding decisions by the controllers, processors and supervisory authorities (Art. 78-79, 82).

Secondly, it must be assumed that these national courts, along with all other national entities involved in the application of the GDPR, are subject to the Convention. This flows from the principle according to which Article 1 of the Convention does not exclude any part of the member States’ “jurisdiction”, which includes EU law, from scrutiny under the Convention (see, among others, Matthews v. the United Kingdom, § 29). As a consequence, national courts must comply with the Convention when applying the GDPR (see mutatis mutandis, among others, Bivolaru and Moldovan v. France). By contrast, the Board, as “body of the Union”, would not in principle be subject to the Convention but only to EU law, including the EU-Charter.

*              *              *

This is particularly relevant in view of the abundant Strasbourg case-law on the protection of personal data, developed by the ECtHR on the basis of Article 8 of the Convention (see the Court’s case-law guide on data protection).

Thus, on the question raised by the referring court, about whether it should of its own motion, when allowing access to confidential data by authorising the lifting of bank secrecy, also ensure the security of these data at the hands of the authority requiring access to them, several key principles developed by the ECtHR would appear to be relevant.

These principles include the duty on the courts reviewing measures designed to allow access to incriminating evidence to carry out a balancing of the various competing interests, having regard, inter alia, to the seriousness of the offence at stake, the necessity and proportionality of the impugned measures, the safeguards implemented in order to confine the impact of the measures to reasonable bounds and the extent of possible repercussions on respect for the private life of the person concerned (see the case-law guide on data protection, referred to above, at §§ 170 er seq.).

As to whether this scrutiny should take place ex ante, i.e. prior to the authorisation given to access the requested data, or ex post, i.e. in the context of a judicial review carried out after any penalty has been imposed on the basis of the personal data at issue, this question is to be decided in light of the effectiveness of the ex post judicial review. It is only if the court carrying out this ex post judicial review is competent to effectively review all the factual and legal aspects of the case as described above, including the necessity and proportionality of the access thus provided to the requested data, and if this court is capable of affording appropriate redress, that such an ex post review will be considered sufficient under Article 8 of the Convention.

Thus, a purely formal legality control of a measure encroaching on a data subject’s rights, prior to the implementation of that measure, as described in § 46 of the CJEU’s judgment, might not suffice under Article 8 of the Convention, if there is no guarantee of an effective ex post facto judicial review. Whether there is such a guarantee will depend on the applicable law but also on the circumstances of the case (see e.g., mutatis mutandis, DELTA PEKÁRNY a.s. c. v. Czech Republic, at §§ 92-93, and Ships Waste Oil Collector B.V. and Others v. the Netherlands, at §§ 191 et seq., which also insists on safeguards against arbitrariness and abuse).

Interestingly, the referring court in the case at hand expressed doubts about the effectiveness of the judicial control provided under Article 79 of the GDPR and referred to the fact that Bulgarian law provides for a prior judicial review (§ 49). The CJEU, however, dismissed this concern, arguing that the judicial review provided for by Articles 78(1) and 79(1) of the GDPR is to take place after the processing of the personal data concerned (§§ 128-130). The CJEU thereby seems to minimise the role of an ex ante judicial review, at odds with the Strasbourg case-law referred to above.

The CJEU however adds that “the Member States must ensure that the practical arrangements for the exercise of the remedies provided for in Article 77(1), Article 78(1) and Article 79(1) of that regulation effectively meet the requirements arising from the right to an effective remedy enshrined in Article 47 of the Charter” (§ 136).

This brings us back to square one, with the CJEU ultimately acknowledging that the key criterion to be applied in this context is the effectiveness of the judicial review available to the data subject. Yet, while the ECtHR sees the effectiveness of the judicial review in the possible combination of an ex ante and ex post review which should also rely on substantive criteria, including a necessity and proportionality assessment, the CJEU locates the judicial review entirely in the final phase of the judicial proceedings, which can be too late, and apparently reduces its effectiveness to a matter of procedural fairness governed by Article 47 of the EU-Charter only.

It would therefore appear that the Luxembourg approach to the judicial review to which data subjects are entitled under the GDPR in a case like the present one offers a lower protection level than the Strasbourg approach. Since the CJEU in this case does not properly interpret any of the EU-Charter rights, it can be left open whether its approach is compatible with Article 52(3) of the EU-Charter.

However that may be, though, this case shows that national judges and prosecutors are well advised in having regard to the Strasbourg case-law when applying the GDPR. If, as in the case at hand, the Strasbourg protection level turns out to be higher than the Luxembourg level, there is nothing to prevent them, in the absence of any primacy of EU law over the Convention, from applying the Strasbourg protection level. National law offering a lower protection level cannot stand in the way of the Strasbourg level either. Thus, by applying the latter, judges and prosecutors not only better protect citizens, but they also protect themselves from being found in breach of the Convention by the ECtHR.

At the heart of the case of EPPO (judicial review of procedural acts) (C-292/23, 8.4.2025) was the interpretation by the CJEU of Article 42(1) of Regulation 2017/1939 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (“the EPPO”), which regulates the judicial review available under that Regulation.

In the case at hand, two directors of a Spanish company were suspected of subsidy fraud with EU funds. Their lawyers appealed against the decision by the European Delegated Prosecutors handling the case to summon another person, Y.C., as a witness. The referring court, before which the appeal was lodged, asked the CJEU about whether it had jurisdiction under EU law to deal with this appeal.

The CJEU first notes that under Article 42(1) of the Regulation, “procedural acts of the EPPO that are intended to produce legal effects vis-à-vis third parties” are subject to review by the competent national courts in accordance with the requirements and procedures laid down by national law. After applying an autonomous and extensive interpretation of the concepts of “procedural acts” and “third parties”, the CJEU states that the question whether such acts produce binding legal effects should be assessed in concreto, i.e. on a case-by-case basis, having regard to the circumstances of each case.

The existence of such binding legal effects will, in the CJEU’s opinion, vary according to the procedural rights to which a suspect or accused person is entitled in a given case. This is because, first, the purpose of the judicial review is precisely to ensure that the EPPO observes the fundamental rights of the persons in respect of whom these procedural acts produce such effects, notably the right to procedural fairness and the rights of the defence, in accordance with Articles 47 and 48 of the EU-Charter; and because, secondly, pursuant to Article 41 of the Regulation, these procedural rights cover not only those laid down by EU law, but also those granted by national law, which vary depending on the Member State concerned (§§ 70-72).

Thus, the scope of the procedural acts by the EPPO producing legal effects on (the rights of) third parties can vary accordingly. This is why the CJEU considers national courts to be best placed to assess the effects of a decision to summon a witness on the rights of a person who is the subject of an investigation, the criterion being whether that decision brings about a distinct change in the legal position of the person concerned, notably by affecting his or her procedural rights (§§ 73, 75).

If that is the case, the question arises as to whether the judicial review to which that person is entitled under Article 42(1) of the Regulation must necessarily be carried out by way of a direct appeal or whether it can also take the form of an incidental question dealt with by the criminal trial court. According to the CJEU, an incidental question is an acceptable option, provided that it is an effective remedy allowing all relevant questions of law and fact, in particular any breaches of rights and freedoms guaranteed by EU law, to be properly addressed (§§ 79-80).

However, pursuant to the principle of equivalence, it would not be acceptable for a direct appeal against acts of the European Delegated Prosecutors to be excluded in a national legal order if the latter provides for the possibility of a direct appeal against analogous acts of a national investigating judge (§ 88).

Observations

First of all, this ruling is a useful confirmation of – and elaboration on – the competence of national courts to carry out a judicial review of acts of the Delegated European Prosecutors. It is also a reminder of the role played by national procedural rights, along with EU procedural rights, in the context of such a judicial review (§ 71).

At the same time, the European Convention on Human Rights is obviously the elephant in the room in this judgment. Unlike EU and national law, it is nowhere being referred to. Yet it seems clear that next to these two last-named sources, the Convention also applies to any judicial review carried out by national courts under Article 42(1) of the Regulation (see No case to answer for the European Public Prosecutor?). There are two reasons for this. First, the Convention is an integral part of the domestic legal system of virtually all Member States of the EU, where it has a major impact on precisely the procedural rights in criminal proceedings. For the sake of clarity, this fact alone should have prompted the CJEU, when identifying the national legal systems as a source of procedural fundamental rights in this context, to at least also flag the role of the Convention in these national legal systems, which the national judges themselves cannot ignore.

Secondly, the Convention applies, in general, to any application of EU law by the domestic courts of the Member States (see, among others, Bosphorus v. Ireland, § 137) and Article 6 of the Convention (right to a fair trial), in particular, is more than likely to apply in its criminal limb to judicial review proceedings conducted before national courts against acts of the EPPO (see, mutatis mutandis, Vera Fernández-Huidobro v. Spain, §§ 108-114), subject to confirmation by the ECtHR when a first case concerning a judicial review under Article 42(1) of the Regulation is brought before it.

Against this background, it seems rather misleading to present, as in paragraphs 79, 80 and 84 of the judgment, the effectiveness of a judicial remedy under Article 42(1) of the Regulation to be sufficiently ensured when the sole procedural rights laid down by EU law are respected. Such a system-focussed – and therefore partial – presentation is at odds with the reality on the ground which is that the national courts entrusted with this kind of judicial review must also apply the procedural rights enshrined in their own national law and/or in the Convention.

This is particularly so in view of the fact that there is, to date, far more Strasbourg case-law on procedural rights in criminal proceedings than there is Luxembourg case-law on that topic, which might sometimes make the former more relevant in practice. Admittedly, the Directives on procedural rights in criminal proceedings seek to reflect a significant part of the Strasbourg case-law on the right to a fair trial in criminal proceedings. However, they contain lacunae (e.g. in Spetsializirana prokuratura) and their interpretation sometimes gives rise to protection drops (e.g. in VB II).

Thus, contrary to the presentation by the CJEU, a wholistic look at the reality on the ground tells us that EU law alone cannot be decisive for the effectiveness of a remedy before domestic criminal courts carrying out judicial review under Article 42(1) of the Regulation. Genuine effectiveness in this field can only be the result of national courts complying also with their own national as well as the Convention procedural rights, along with the relevant EU procedural rights, as indeed suggested by Article 41(3) of the Regulation itself.

In the case of Deldits (C-247/23, 13.3.2025), the CJEU ruled on the right to rectification of incorrect personal data appearing in a public register, as provided for by Article 23 of Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation”, “GDPR”).

In the case at hand, VP, an Iranian national who had obtained refugee status in Hungary, unsuccessfully applied for the rectification in the asylum register of their gender identity from female to male. VP’s application, which relied on Article 16 of the GDPR (right to rectification of inaccurate personal data), was rejected by the Hungarian asylum authority on the ground, inter alia, that VP had not proved that they had undergone gender reassignment surgery.

In light of Article 5(1)(d) of the GDPR (principle of the accuracy of personal data), the CJEU first holds that since the purpose of collecting personal data is to identify the data subject, these data should relate to VP’s gender identity at the time of their registration in the asylum register and not the gender identity assigned to them at birth. National law cannot stand in the way of the right to have incorrect data rectified accordingly, pursuant to Articles 8(2) of the EU-Charter and 16 of the GDPR (§§ 32-37).

The CJEU then examines, in light of Article 23 of the GDPR, which regulates the restrictions which can be applied to the rights and obligations laid down in the GDPR, the Hungarian administrative practice according to which the exercise of the right to rectification of the personal data relating to the gender identity of a natural person is conditional upon the production of evidence of, in particular, gender reassignment surgery.

The CJEU finds this practice not to fulfil the requirements of Article 23 and, consequently, to be incompatible with the right to rectification of personal data, within the meaning of Article 16, because a) the said practice is not provided for by a legislative act, and b) the only evidence accepted in support of the request for rectification of the person’s gender identity is evidence of a gender reassignment surgery.

*              *              *

What is noteworthy, from a Convention point of view, is the CJEU’s reasoning leading to that conclusion, notably on the question whether the restrictions entailed by the said practice respect the essence of the fundamental rights and freedoms involved and are necessary and proportionate, as required by Article 23. In holding that this is not the case, because the said practice undermines the essence of, in particular, the right to the integrity of the person and the right to respect for private life, as enshrined in Articles 3 and 7 of the EU-Charter, the CJEU also refers to case-law of the ECtHR to the same effect, notably X and Y v. Romania and Garcon and Nicot v. France.

The CJEU thereby relies on Article 52(3) of the EU-Charter, according to which the rights guaranteed by the Charter have the same meaning and the same scope as the corresponding rights guaranteed by the Convention, the latter constituting a minimum threshold of protection (§ 46).

The impact of such references by the CJEU in the application of the GDPR should not be underestimated, as they confirm the relevance of the Convention in this legal area, more particularly in making clear that restrictions under the GDPR not only must comply with the Charter but also should not lower the Convention protection level. Such an indication is even more significant in view of the fact that the GDPR itself makes no reference to the Convention, except in Recital 73 dealing with restrictions. This somehow suggests that the EU lawmaker considered the Convention to be of little importance for the GDPR.

Nowhere else is there any explicit indication by the EU lawmaker that the GDPR does not intend to lower the Convention protection level, as one can find in numerous other pieces of secondary legislation, e.g. in their non-regression clauses. Admittedly, Recital 4 states that the GDPR “respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties”. But can such a general formulation in a recital be equated with a proper non-regression clause?

The value of such non-regression or equivalent clauses becomes clear when considering that pursuant to Articles 78 and 79 of the GDPR, national courts are competent to deal with the judicial remedies which data subjects are entitled to use against supervisory authorities, controllers or processors acting on the basis of the GDPR. As with any other EU law context, when applying the GDPR these national courts must also comply with the Convention (see, among others, Bivolaru and Moldovan v. France). Mutatis mutandis, this, in principle, also holds true for all other national bodies or agents entrusted with the performance of duties under the GDPR, since no part of the legal systems of the EU Member States is outside the scope of the ECtHR’s jurisdiction as determined by Article 1 of the Convention (Bosphorus v. Ireland, § 153).

The CJEU can therefore only be commended for referring in this important area to Article 52(3) of the EU-Charter and the threshold function it confers on the Convention in EU law (on this function, see Optionality of the Convention). First, this is a useful reminder that the application of the GDPR by national authorities is not outside the scope of the Convention. Secondly, the reference to the threshold function of the Convention is also an indication that while it can perhaps be assumed that the GDPR is generally not lowering the Convention protection level, this should nonetheless, by virtue of Article 52(3) of the EU-Charter, be double-checked at national level in case of doubt in a concrete case, if necessary by referring the issue to the CJEU for a preliminary ruling under Article 267 TFEU.