Baptism register data may be erased under the GDPR, says CJEU advocate general

A person baptized in childhood who, upon reaching adulthood, wishes to leave the religious community may have the right to have their personal data erased from the baptism register if the organization retaining the information fails to demonstrate the existence of compelling legitimate grounds that override the person’s rights. This is the interpretation proposed by Advocate General Laila Medina in Case C-12/25, Bisdom Gent, pending before the Court of Justice of the European Union.

In brief

Baptism registers may fall within the scope of the GDPR even if they are kept exclusively on paper, because they may constitute a structured filing system of personal data.

After a person objects to the processing of their data, the religious community must demonstrate compelling legitimate grounds for continuing the processing, and the assessment must be made on an individual basis.

The proper administration of the sacraments may constitute a legitimate interest of the Church, but it does not automatically justify retaining all of a person’s data indefinitely.

Archiving in the public interest or historical research may allow certain data to be retained only under the conditions and with the safeguards provided for by the GDPR, including compliance with the principle of data minimization.

A note stating that a person has left the Church or crossing out data that remains legible does not constitute erasure. The Advocate General’s conclusions are not binding on the judges of the CJEU.

The case originates from the situation of JM, a Belgian citizen baptized in 1955 in the Bijloke parish in Ghent. As an adult, he asked the Diocese of Ghent to remove any reference to him from the Church’s physical or digital registers and archives, invoking the rights granted to him by the General Data Protection Regulation.

The Diocese subsequently recorded the fact that JM had left the Roman Catholic Church. His personal data in the baptism register were crossed out, but remained legible. The person considered that this action did not meet his request for erasure and complained to the Belgian Data Protection Authority.

In Decision 169/2023, the Belgian authority ordered the Diocese of Ghent to uphold the right to object and the request for erasure. The authority accepted that the Church may have a legitimate interest in retaining baptism registers, including for the proper administration of the sacraments, but considered that this interest does not automatically justify continuing the processing when a person expressly declares that they wish to leave the Church.

The Diocese challenged the decision, and the Brussels Court of Appeal asked the CJEU to clarify how the right to data protection and religious freedom should be balanced, whether paper baptism registers fall within the scope of the GDPR, and what erasure of data effectively means in the case of a physical register that also constitutes a historical record.

Laila Medina considers, first of all, that the GDPR applies to such registers. The Regulation is not limited to digital databases. Manual processing falls within its scope if the information forms part of a structured filing system of personal data.

In the Advocate General’s view, Catholic baptism registers meet this condition. Baptisms are recorded according to the parish in which they took place and, within the registers, are arranged chronologically. This organization makes it possible to retrieve information about a particular baptism when the place and time at which the sacrament was administered are known.

The fact that the register exists only on paper does not alter this conclusion. Neither the small number of people who have access to it nor the need to know certain information before carrying out a search removes its character as a structured filing system.

The autonomy of churches and religious freedom also do not exclude the application of the GDPR. EU law recognizes the status and autonomy of religious organizations, but they must comply with European data protection rules when processing personal data.

The analysis changes, however, depending on when the person objects to the processing. Medina considers that retaining data in the baptism register before such an objection is made may, subject to verification by the national court, be based on a legitimate interest of the Church even in the absence of the person’s express consent.

Such an interest may be the proper administration of the sacraments. In the Roman Catholic Church, baptism is administered only once, and records of baptized persons may make it possible to verify that the sacrament has already been received. The registers may also be relevant when a person subsequently requests other sacraments for which proof of baptism is required.

The existence of a legitimate interest does not, however, end the analysis. The processing must be necessary to achieve the objective pursued and must comply with the principle of data minimization. If the same purpose can reasonably be achieved by a method that affects the person’s rights less, retaining the data in its existing form may no longer be necessary.

The requirements become stricter when the person exercises their right to object. The GDPR provides that the controller may no longer continue processing unless it demonstrates the existence of compelling legitimate grounds that override the interests, rights, and freedoms of the data subject.

This assessment cannot be made in the abstract for all persons requesting the removal of data from baptism registers. The court must examine the specific situation, including the reasons why the person wishes to have the data erased and the effects that refusal may have on them.

On one side of the balance are the Church’s religious freedom and organizational autonomy, including its interest in administering its sacraments according to its own rules. On the other side are the person’s right to privacy, protection of personal data, freedom of thought, conscience, and religion, and, in certain situations, the right to bodily integrity.

The Advocate General also attaches importance to the fact that the person in the case before the court was baptized in childhood. Their data were entered in the register following a decision made by their parents, not through a personal choice expressed in adulthood. Medina questions the idea that such a parental decision could create, for an entire lifetime, an inability to object to the retention of sensitive data concerning religious affiliation.

The concrete impact on the person may also be relevant. There may be situations in which the continued retention of data by a religious community from which someone wishes to withdraw has significant personal consequences. In such cases, these effects must be included in the court’s assessment and cannot be disregarded merely because the information is not published.

The Diocese also invoked the historical value of the registers and the need to retain them for archiving in the public interest or historical research. The GDPR allows exceptions to the right to erasure for such purposes, but the conditions are strict.

For archiving in the public interest, it is not sufficient for a document to have historical value for the organization holding it. The conditions laid down by European and national law must be met, and the processing must pursue an interest that goes beyond the organization’s internal interests. If historical research purposes are invoked, they must be capable of contributing to the development of knowledge.

In addition, appropriate safeguards for individuals’ rights must exist, and the principle of data minimization must be respected. The controller must also assess whether the archiving or research purposes can be achieved using information that no longer permits the person to be identified.

Medina also draws an important distinction between erasing personal data and erasing the historical fact of baptism. The GDPR does not allow a person to require the Church to consider that the baptism did not take place or that it does not produce the religious effects attributed to it by the Church. The Union does not intervene in such doctrinal matters.

The register may therefore retain information concerning the fact that a baptism took place at a certain place and time, provided that the person concerned can no longer be identified or is no longer easily identifiable. The principle of data minimization is essential for determining which information must be removed and which may remain.

By contrast, simply entering a note stating that the person has left the Church does not amount to erasure. Such a change may even add new personal information to the register. Nor is drawing a line through the name and other data sufficient if they remain readable.

Erasure does not necessarily require destroying the page or physically cutting the information out of the register. Methods may be used by which the relevant data become illegible without affecting information about other persons recorded on the same page. What matters is that the person can no longer be identified or is no longer easily identifiable through the data that were to be erased.

Laila Medina’s conclusions do not resolve the dispute and do not oblige the Court of Justice to adopt the same interpretation. The role of the Advocate General is to independently propose a legal solution to the Court. The CJEU judges will deliberate separately and will subsequently deliver judgment in Case C-12/25.

The judgment will be relevant beyond the Belgian dispute because it will clarify how the right to erasure must be balanced against religious freedom and the autonomy of churches throughout the Union. The issue does not concern the religious existence or validity of baptism, but rather the limits within which an organization may continue to retain identifiable personal data after a person has explicitly objected to such processing.

https://2eu.brussels/ro/news/datele-din-registrele-de-botez-pot-fi-sterse-in-baza-gdpr-spune-avocata-generala-a-cjue