CJEU Rules Individuals Can Demand Erasure from Church Baptismal Records Under GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU Advocate General's opinion in case C-12/25 affirms that Article 17 GDPR's 'right to erasure' extends to religious organizations maintaining baptismal registers, when continued data processing causes emotional distress to individuals who have left the faith. This ruling highlights that no organization — including religious institutions — is categorically exempt from GDPR obligations simply by virtue of their historical record-keeping traditions. The burden falls on the data controller (the Diocese) to demonstrate overriding legitimate grounds for retention, such as archiving or historical research, rather than assuming perpetual lawfulness of processing. Failure to honor valid erasure requests without documented justification exposes organizations to regulatory enforcement and reputational harm.
Tactical Insight
Immediate actions
- Audit all personal data held in legacy or traditional records (including physical registers) to assess GDPR applicability and legal basis for processing.
- Establish a documented process for receiving, logging, and responding to Data Subject Requests (DSRs), including erasure requests, within the statutory 30-day window.
Policy & Legal Alignment
- Review and update data retention policies to explicitly address when archiving or historical research exemptions under Article 17(3) GDPR legitimately override erasure requests.
- Engage legal counsel to map all data processing activities against lawful bases and document legitimate interests assessments (LIAs) for long-term record retention.
- Ensure privacy notices accurately reflect the types of data held, the purposes of processing, and individuals' rights under GDPR.
Long-term improvements
- Train staff responsible for record management on GDPR rights, particularly Articles 17 and 21, so erasure and objection requests are handled correctly and escalated appropriately.
- Implement a formal Data Protection Impact Assessment (DPIA) process for any data processing that may cause emotional, reputational, or psychological harm to data subjects.
- Appoint or verify a designated Data Protection Officer (DPO) to provide ongoing compliance oversight across all data processing activities, including those rooted in tradition or canon law.