CJEU Opinion: GDPR Right to Erasure Applies to Church Baptismal Registers

Written by AI from the linked story. Not reviewed by an editor. How this works

This case highlights that GDPR's reach extends beyond traditional digital systems to any structured filing system, including physical or ecclesiastical records like baptismal registers. A data subject's right to erasure under Article 17(1)(c) GDPR can be triggered by emotional distress caused by unwanted affiliation — not just by unlawful processing. Religious organizations often underestimate their obligations as data controllers, leaving them exposed to legal challenges when they fail to honor data subject rights. This ruling matters because it reinforces that no organization — secular or religious — is exempt from GDPR compliance when processing personal data in a structured manner.

Tactical Insight

Immediate actions

Audit all physical and digital filing systems to determine whether they constitute GDPR-regulated 'filing systems' under Article 4(6).
Establish a documented process for handling data subject erasure requests (Article 17) within the legally required one-month timeframe.

Policy & Governance improvements

Appoint a Data Protection Officer (DPO) or equivalent responsible party for all organizations processing personal data, including religious entities.
Draft and publish a clear retention and erasure policy that defines lawful bases for processing and conditions under which data will be deleted.
Train staff on recognizing and escalating data subject rights requests, including the right to erasure and the right to object.

Detection & Response measures

Implement a register of processing activities (ROPA) as required by GDPR Article 30 to maintain visibility over all data holdings.
Conduct periodic Data Protection Impact Assessments (DPIAs) for sensitive categories of data, including religious belief data classified under Article 9.