[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flnUYAm5yaluVvOf_wuPqV4y2aYbFkYfbjEuGU88tkZU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"37c6717b-76a1-4903-9245-a0fd1ee0b725","cjeu-opinion-gdpr-right-to-erasure-applies-to-church-baptismal-registers","d2eb42fb-e57a-4167-82a5-cf77b68dc3a3","CJEU Opinion: GDPR Right to Erasure Applies to Church Baptismal Registers","This case highlights that GDPR's reach extends beyond traditional digital systems to any structured filing system, including physical or ecclesiastical records like baptismal registers. A data subject's right to erasure under Article 17(1)(c) GDPR can be triggered by emotional distress caused by unwanted affiliation — not just by unlawful processing. Religious organizations often underestimate their obligations as data controllers, leaving them exposed to legal challenges when they fail to honor data subject rights. This ruling matters because it reinforces that no organization — secular or religious — is exempt from GDPR compliance when processing personal data in a structured manner.","**Immediate actions:**\n- Audit all physical and digital filing systems to determine whether they constitute GDPR-regulated 'filing systems' under Article 4(6).\n- Establish a documented process for handling data subject erasure requests (Article 17) within the legally required one-month timeframe.\n\n**Policy & Governance improvements:**\n- Appoint a Data Protection Officer (DPO) or equivalent responsible party for all organizations processing personal data, including religious entities.\n- Draft and publish a clear retention and erasure policy that defines lawful bases for processing and conditions under which data will be deleted.\n- Train staff on recognizing and escalating data subject rights requests, including the right to erasure and the right to object.\n\n**Detection & Response measures:**\n- Implement a register of processing activities (ROPA) as required by GDPR Article 30 to maintain visibility over all data holdings.\n- Conduct periodic Data Protection Impact Assessments (DPIAs) for sensitive categories of data, including religious belief data classified under Article 9.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 4(6) — Definition of Filing System","GDPR Article 9 — Processing of Special Categories of Data","GDPR Article 17 — Right to Erasure ('Right to be Forgotten')","GDPR Article 17(1)(c) — Erasure upon Objection to Processing","GDPR Article 21 — Right to Object","GDPR Article 30 — Records of Processing Activities","GDPR Article 35 — Data Protection Impact Assessment","NIST Privacy Framework PR.DS-P4 — Data Retention and Disposal","CIS Control 3 — Data Protection","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)",{},"published","2026-10-06T08:20:36.137207+00:00","2026-10-06T08:20:36.043+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-12\u002F25&diff=53293&oldid=0","cjeu-c-12-25-66aa99","CJEU - C-12\u002F25",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]