This case analyzes the balance between the right to erasure of personal data and the legitimate interest of a religious institution to keep sacramental registers, specifically the baptism register. It illustrates the complexity of applying the GDPR when it conflicts with other fundamental rights, such as freedom of religion and the autonomy of religious organizations.

Facts and context

The Data Protection Authority (DPA) issued a decision ordering the Diocese of Ghent to delete a person's data from the baptism register.

The case originated from a complaint by a baptized person whose request to erase their data from the baptism register was refused by the diocese, which only offered to add a marginal note in the register indicating their wish to leave the Church.

Reasons for the decision

• Legal basis for processing (Article 6 of the GDPR): The authority examined the legitimate interest claimed by the diocese, namely the need to keep a record of baptism to prevent a person from receiving this sacrament more than once. While recognizing the legitimacy of this interest, the DPA concluded that the conditions of necessity and balancing were not met. On the one hand, the paper and local nature of the register does not allow effective verification if a person has already been baptized, making the processing unnecessary for the purpose. On the other hand, the lifelong retention of sensitive data is deemed disproportionate in light of the person's explicit wish to distance themselves from the Church, thus prioritizing their interests over those of the religious institution.

• Right to erasure and right to object (Articles 17 and 21 of the GDPR): The processing was considered unlawful due to the failure to balance interests, making the complainant's right to erasure applicable. Furthermore, the authority found that the objection to processing raised by the person was legitimate, which constitutes another ground justifying data erasure.

• Transparency obligation (Articles 13 and 14 of the GDPR): The DPA also noted that the information provided by the Church at the time of baptism was insufficient, particularly regarding the data retention period, which was not specified.

Authority's decision

Moreover, the authority ordered the Diocese of Ghent to comply with the objection to processing and the complainant's request for data erasure.

On 11 December 2024, the Market Court, seized on appeal by the Diocese of Ghent, decided to refer five preliminary questions to the Court of Justice of the European Union (CJEU). These concern the interplay between the right to erasure, freedom of religion, the physical nature of the register, its archival value, and whether a mere annotation can be considered "erasure" within the meaning of the GDPR.

On 1 October 2026, Advocate General Medina delivered her opinion, stating that the GDPR does apply to baptism registers and that a person can in principle request the erasure of their data. She specified that the Church may oppose this if it demonstrates legitimate and compelling grounds, requiring a case-by-case balancing. The Advocate General emphasized that the person's emotional distress must be taken into account and that a mere annotation is insufficient to satisfy an erasure request, as the data must be rendered unreadable.

Lessons

This decision confirms / clarifies / recalls that:

• The validity of processing based on legitimate interest relies on a concrete and strict balancing, where the necessity of processing to achieve the purpose and proportionality regarding the rights of the data subject must be rigorously demonstrated.

• The exercise of the right to object by a data subject, when deemed legitimate, entails the obligation for the controller to cease processing and erase the data, unless it demonstrates overriding legitimate grounds.

• "Erasure" of data implies rendering it unreadable or making the person no longer identifiable; a mere annotation in the margin of a register does not constitute a sufficient measure to comply with the right to erasure.