Does the GDPR trump the Bible? Probably not, but it might trump religious administration

From a data protection perspective, baptismal records are a very interesting phenomenon. Essentially, whenever a person is baptised, a record is kept of that fact. In Belgium, these records are kept locally at the individual parishes, solely on paper.

While the records are not digital, they are undoubtedly a ‘filing system’ in the sense of the GDPR, so the registers should in principle be kept in accordance with EU data protection law. This is not always trivial, especially since the expectations of data subjects may clash with the traditions of the Church.

One discussion that has been ongoing for some time in Belgium (as in other Member States such as Ireland), is the fate of baptismal records when a person no longer wishes to be registered as a baptised person by the Catholic Church. The baptism as such is an objective fact: even a person who feels very strongly about no longer being a Catholic, or even feels that they have never been Catholic, cannot deny that the baptism has happened. But historical truth is not an absolute defence against the GDPR’s right to be forgotten: what matters not is whether the event indeed happened, but whether the data controller still has a right to keep the personal data. The matter thus hinges on legal basis and proportionality, to a large extent.

The Belgian data protection authority was recently called upon to rule on a compliant from a baptised data subject, who demanded that their records would be removed. The traditional practice of the Catholic Church thus far was not to delete the records, but to add a note to them, clarifying that the person no longer wished to be a part of the Catholic faith. Thus, the personal data of the baptised person was amended, rather than deleted.

The legal defence of the Catholic Church for this practice essentially hinged on the fact that they had a legitimate interest in keeping the records, because they were necessary to manage the Church’s activities: since the Church only allows a person to be baptised once, records were needed to avoid identity fraud. Moreover, it argued that the records had historical relevance, and that deleting them would falsify history. The Irish DPC ruled on a very similar claim in June 2023, and accepted this argument.

However, data protection authorities can move in mysterious ways. In December 2023, the Belgian data protection authority took the opposite stance, ordering the diocese of Ghent to delete the baptismal record of a complainant - one of many with comparable cases in Belgium – essentially requiring them to be struck out or physically destroyed, since it was kept on paper.

And in fact, that practice of keeping fragmented records on paper might have been quite decisive. One of the considerations of the Belgian DPA was that the records were not actually useful in combating identity fraud: since they were on paper and spread across parishes, they could not be used by any given parish in practice to determine if someone was already baptised. Since they were not sufficiently useful for that purpose, they were also by definition not necessary for the Church’s legitimate interest to protect itself against fraud.

A neat workaround for the Church could thus have been to create a central digital register, which could be useful to achieve that purpose. But possibly sensing that option, the DPA also noted that, at any rate, lifelong record keeping was excessive to achieve this purpose, and that the legitimate interest of the Church was outweighed by the harm to persons with a strong personal interest in no longer being seen as a part of the Church. On this point, the Belgian ruling is diometrically opposed to the finding of the DPC.

The case is very likely to be appealed, especially given that the Irish DPA ruled differently. In the meantime, the Catholic Church in Belgium might rue the fact that, unlike some other Member States, Belgium never adopted diverging rules on data protection with respect to churches and religious associations. A rarely encountered but very salient provision of the GDPR is article 91, which essentially stipulates that the GDPR is sidelined by specific national data protection rules for churches and religious associations or communities, but only if those already applied at the time of entry into force of the GDPR, and if they are “”brought into line with this Regulation”. In Poland for instance, this has been a saving grace for baptismal records.

But unless the Belgian DPA reconsiders, it would seem that Belgian baptisms are not like Polish or Irish ones, at least from a data protection perspective.

Article provided by INPLP member: Hans Graux (Time.Lex, Belgium)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)