A/HRC/41/45 Regulation (EU) 2016/679. Article 9 of the Regulation states that the processing of personal data revealing, among other things, sexual orientation is prohibited unless specific conditions are fulfilled. Based on the various submissions received from European Union or European Economic Area member States, 100 the Independent Expert notes that the Regulation has been transposed or is in the process of being transposed into national legislation in several States. 2. Emergence of human rights principles in data collection and management 46. The submissions received included examples of safeguards adopted in the context of the collection, use and storage of data related to sexual orientation and gender identity and measures adopted to mitigate the associated risks. In the opinion of the Independent Expert, particularities specific to sexual orientation and gender identity should be identified and, when relevant and necessary, taken into account in the design of data collection and management exercises. The mandate concurs with UNDP that related standards should develop first as self-enforced standards and later as mandatory international standards. 101 (a) Do no harm 47. The principle of “do no harm” should always be respected. The decision to initiate and continue data-related activities, especially in the context of negation, stigmatization and hostile legal frameworks, should be made on the basis of an assessment of threats and risks to the safety, resources and rights of those involved in the activity and of the larger community of lesbian, gay, bisexual, trans and gender-diverse persons. Such an assessment should be made with the participation of the affected communities, peoples or populations. 48. The design of data collection and management systems, including, most importantly, considerations regarding evaluation of consent, must be subject to an ethical review102 and a review by an independent body to ensure compliance with human rights standards. 103 Approaches to this have varied. Agencies may establish such bodies within the public administrative structure, and a common institutional approach to ensure accountability is through research ethics committees, sometimes referred to as institutional review boards. For example, the Universal Declaration on Bioethics and Human Rights states that ethics committees should be established in each country in order to assess ethical, legal and social issues related to all research involving human beings. (b) Self-determination 49. The ability to determine one’s own identity, including with regard to sexual orientation and gender, is central to the right to equal recognition before the law established in universal and regional human rights instruments. 104 The Office of the United Nations High Commissioner for Human Rights has stated that devising disaggregation of indicators (or not) is not a norm- or value-neutral exercise.105 It has also stated that personal identity characteristics, particularly those that may be sensitive, such as religion, sexual orientation, gender identity or ethnicity, should be assigned through self-identification, and not through imputation or proxy.106 In addition, the concepts of sexual orientation and gender identity vary greatly across the world; a rich diversity of sexual orientations, gender identities and gender expressions exist in all regions as a result of long-established cultures and traditions. Some of those and other identities transcend Western concepts of gender identity, gender 100 101 102 103 104 105 106 Belgium; Denmark; France; Germany; Ireland; the Netherlands; Norway; Portugal; Serbia; Spain; Sweden. See also the submission from the Greek National Commission for Human Rights. Submission from UNDP. Discussion at the meeting of experts coorganized by the Independent Expert and UNDP, 14 February 2019. Declaration of Taipei on Ethical Considerations Regarding Health Databases and Biobanks, para. 19. A/73/152, para. 20. A Human Rights-Based Approach to Data, p. 2. Ibid., p. 12. 15