A/HRC/41/45 expression or sexual orientation and, depending on the language, the terms “sex”, “gender”, “gender identity” and/or “sexual identity” are not always used or distinguished.107 50. Within this context, it is the obligation of the State to recognize and respect selfdetermination and to ensure that categories of identity are drawn from those set by the members of the local population. (c) Privacy and confidentiality 51. The right to privacy is recognized as a fundamental right under international human rights instruments, 108 establishing a personal sphere within which an individual may determine whether and how personal information is disclosed. One means through which individuals maintain control over their own personal information is the process of consent, whereby they are provided with the ability to limit the use of personal data to lawful purposes or to the purposes consented to when they first disclosed elements or facets of their private life,109 which include their sexual orientation and gender identity. 110 The right to information entails the right of data subjects to be informed about the collection of their data. For instance, the law on personal data protection adopted in Georgia provides that data subjects have certain rights to “control the process”, as they are entitled to ask questions regarding the kind of data that is being processed, the purpose of the data processing, the legal basis for the data processing, how the data was collected, to whom the data was submitted; and the grounds for and purpose of the submission of the data. 111 52. States that have transposed into national legislation Regulation (EU) 2016/679 have strong privacy regulations, as the Regulation requires anonymization of data following collection and compilation. It also requires that data such as names and addresses be deleted after a defined time interval has expired.112 53. Various submissions contained references to legal safeguards and good practices in relation to privacy and confidentiality.113 In particular: • The general law on the protection of personal data covering federal, state and municipal authorities and other entities and organizations in Mexico, as well as transparency laws in that country, treat issues related to sexual orientation, gender identity and gender expression as confidential personal data, providing for special protection of such data.114 • The Privacy Act 1993 of New Zealand contains 12 information-privacy principles that guide the way government agencies and businesses handle personal information, including in relation to the collection, storage, accuracy, retention and disclosure of, and access to, personal information.115 • In North Macedonia, the Law on Personal Data Protection defines the responsibilities of the persons authorized to process personal data, as well as fines that are to be imposed on authorized persons who have acted contrary to the statutory authorizations and exposed any such data to a third, unauthorized, person.116 107 108 109 110 111 112 113 114 115 116 16 A/73/152, para. 3; see also para. 4. Universal Declaration of Human Rights, art. 12; International Covenant on Civil and Political Rights, art. 17. Human Rights Committee, general comment No. 16 (1988) on the right to privacy, para. 10. Discussion at the meeting of experts coorganized by the Independent Expert and UNDP, 14 February 2019. Submission from the Women’s Initiatives Supporting Group (Georgia). See also submissions from, among others, Ireland and Spain. Submissions from Ireland; Portugal; Serbia; Spain; Sweden; Venezuela (Bolivarian Republic of); The Fenway Institute; National Human Rights Commission of Mexico; Ombudsman’s Office of the Bolivarian Republic of Venezuela. See submissions from Mexico; the National Human Rights Commission of Mexico; Amicus (Mexico). Submission from the Human Rights Commission of New Zealand. Submission from the LGBTI Support Centre.