This story has been updated. Please see the most recent update below.

On December 19, 2023, the Belgian Data Protection Authority (Belgian DPA) published its decision No. 169/2023, in which it ordered the Diocese of Ghent to comply with the request of a baptized person to be deleted from the baptismal register, following a complaint from an individual.

Background to the decision

An individual, who wished to withdraw from the Catholic Church, lodged a complaint with the Belgian DPA after their request to be deleted from all Catholic Church files, including the baptismal register, was denied by the Diocese of Ghent. The Diocese of Ghent alleged that the Church does not delete data from the baptismal registers, but rather adds an annotation reflecting the person's wish to leave the Church in the margin of the register. The Diocese of Ghent also argued the historical value of baptismal registers.

Findings of the Belgian DPA

After hearing arguments from both sides, the Belgian DPA found that the processing of the complainant's personal data violated Articles 5(1)(a), 6(1)(f), and 9 of the General Data Protection Regulation (GDPR).

In particular, the Belgian DPA noted that, even though the Diocese of Ghent relied on legitimate interests for processing personal data, it failed both the necessity and the weighing of interests tests when confronted with the interests, fundamental rights, and freedoms of the data subject. As such, the Belgian DPA concluded that the data processing was not suitable for achieving the intended interest and did not meet the requirements of purpose limitation and data minimization required by Articles 5(1)(b) and 5(1)(c) of the GDPR.

The Belgian DPA further decided that processing data based on canon law is not grounds for evading the obligations set under the GDPR.

Moreover, the Belgian DPA found that the Diocese of Ghent failed to comply with the right to erasure, in violation of Articles 12(2), 12(4), and 17(1)(c) of the GDPR. In the view of the Belgian DPA, the Diocese of Ghent also failed to comply with Articles 12(1), 12(3), and 13 of the GDPR by not providing the complainant with clear information.

Outcomes

In light of the above, the Belgian DPA issued a reprimand and ordered the Diocese of Ghent to:

• properly comply with the complainant's erasure request; and
• stop processing the personal data of individuals who choose to leave the Church.

The Diocese of Ghent has 30 days from the notification of the decision to comply with the corrective measures.

You can read the press release here, the European Data Protection Board summary here, and the decision, only available in Dutch, here.

Updated: December 12, 2024

Markets Court requests preliminary ruling from CJEU

On December 11, 2024, the Belgian DPA announced via a LinkedIn post that, on the same date, the Markets Court requested a preliminary ruling from the Court of Justice of the European Union (CJEU), following an appeal from the Diocese of Ghent.  

The Markets Court submitted the following considerations to the CJEU for ruling:

• whether Article 17 of the GDPR applies to members of the Catholic Church who want to distance themselves from the Church;
• whether Article 17(1)(c) of the GDPR has an effect on the data subject's freedom of religion;
• whether the GDPR applies to baptismal records which are not digitized;
• whether the historical value of the baptismal records means the application of exception under Article 17(3)(d) of the GDPR; and
• whether the right to erasure can be satisfied by annotating in the baptismal records that the individual has left the Church.

You can read the LinkedIn post in French here and in Dutch here, and the Markets Court decision, only available in Dutch, here.