According to the BE DPA, a baptized person has the right to be deleted from the baptismal register

---

Background of the case

A baptized person applied to the diocese of Ghent to be deleted from all Catholic Church files, including the baptismal register. However, the Church does not delete the data from the baptismal registers, but rather adds an annotation reflecting the person's wish to leave the Church in the margin of the register.

The right to data deletion, enshrined in the General Data Protection Regulation (GDPR), is not absolute and can only be exercised under certain conditions. The Catholic Church considers that it has a legitimate interest in retaining the data contained in the baptism register, as such retention is necessary for the purpose of data processing, and that the conditions applicable to a request for deletion are therefore not met in this type of case. She also invoked the archival value of this data, which would prevent its deletion.

The unsuccessful party then lodged a complaint with the Data Protection Authority.

The Church's interest and the data subject's interest

The Church's legal basis for processing baptism data is its legitimate interest in preventing possible (identity) fraud, since, according to Catholic doctrine, a baptism can only take place once. It is therefore necessary to keep a record of it.

For the Belgian DPA, this is indeed a legitimate interest on the part of the Church.

However, this legitimate interest can only be validly invoked as a basis for data processing if the processing is necessary to achieve this objective, and if the interest of the data subject (here: the complainant) does not override the interest of the organization processing the data (here: the diocese of Ghent).

In the present case, the DPA finds that these two conditions are not met:

• On the one hand, since the register is only kept in paper form within a single parish (that of the baptism), it is not always possible to verify whether or not the baptism took place. Data processing as it is carried out today does not in fact prevent a person from receiving the same sacrament twice, and is therefore not a priori appropriate for achieving the desired purpose.
• On the other hand, the lifetime retention of all the complainant's data - including data not strictly necessary to determine whether a person has already been baptized - is disproportionate from the moment the complainant expressly states that he or she wishes to distance himself or herself from the Catholic Church. In this case, the interests of the complainant override those of the Church.

Consequently, the data processing in question is deemed unlawful, which means that the complainant can exercise his right to have the data deleted. Moreover, data must also be deleted when a legitimate objection to data processing is raised, which is therefore the case here.

Furthermore, the DPA considers that the information provided by the Church regarding the processing of baptismal data is not sufficient, in particular because it does not include any indication to the person (or his/her parents) as to how long the data will be kept.

Order to comply with erasure request

For this reason, the DPA decided to order the Bishopric of Ghent to comply with the complainant's request to object to the processing of his data, and with the request to erase his data.

Hielke Hijmans, Chairman of the Litigation Chamber of the Belgian Data Protection Authority: "In this case, several fundamental rights are at stake. In our decision, we only express ourselves on the application of the GDPR to the data processing carried out by the diocese of Ghent, as is our role. From a data protection point of view, the lifelong processing of data, moreover of a sensitive nature, of a person who has asked to leave the Church cannot be justified if such processing is neither proportional nor strictly necessary to the admittedly legitimate interests of the Church. These conditions were not met in this case".

Parties affected by the decision have 30 days in which to lodge an appeal.

Important note: several cases concerning the data protection aspects of the de-baptization procedure are currently before the Litigation Chamber of the Belgian Data Protection Authority. The decision summarized in this press release concerns only one of these cases.

Update 11 december 2024 : The Market Court refers preliminary questions to the Court of Justice of the EU

The Market Court decided today to refer preliminary questions to the Court of Justice of the European Union in the appeal that the diocese of Ghent had filed against decision 169/2023 of the Belgian Data Protection Authority (BE DPA).

Given, on the one hand, that different European authorities have rendered divergent decisions on a similar subject and, on the other hand, that the question of erasure from the baptismal register is part of a broader social context than just the proceedings at hand, the Market Court decided to ask the CJEU whether, in summary, the right to freedom of religion and the right to data protection and data erasure are absolute and what criteria are pertinent to consider in the event of a conflict between these fundamental rights.

More specifically, the Market Court asked 5 preliminary questions, which are summarised below:

• Does a person who was baptised as a minor and wants to disassociate from the church as an adult have the right to have his/her data erased from the baptismal register?
• Does it make a difference that, according to the data controller, the data erasure affects his fundamental rights (freedom of religion)?
• Does it make a difference that the baptismal register is not digital but takes the form of a book?
• Does it make a difference that the baptismal register itself is a historical artefact so that the data processing is also done for archival purposes?
• To the extent that a person has the right to request the erasure of his/her data from the baptismal register and no exception to that right is applicable, can an annotation that a person has left the church in the margin of the baptismal register be considered equivalent to a data erasure within the meaning of the General Data Protection Regulation?

The judgment and the precise questions presented to the CJEU can be accessed via this link (in Dutch).

Hielke Hijmans, Chairman of the Litigation Chamber of the BE DPA : “This is a very nice judgment for the BE DPA that follows our analysis on a large number of points and puts the fundamental question of the balance between data protection and freedom of religion before the highest European court.”