Francisca Pérez-Madrid is Professor of Law and Religion at the University of Barcelona.
On 1 October 2026, Advocate General (AG) Laila Medina of the Court of Justice of the European Union (CJEU) delivered her opinion in the Diocese of Ghent (Bisdom Ghent) (C-12/25). The opinion addresses whether individuals who leave the Catholic Church can rely on the EU’s General Data Protection Regulation (GDPR) in requesting removal of their names from a baptismal register. In keeping with CJEU procedure, the opinion precedes and can inform the Court’s final judgment on the matter. The AG opinion does not recognize an automatic right to erasure, and it discusses respect for church autonomy. Nevertheless, in my view, the opinion is concerning because it leaves to the discretion of each national court a decision that rightly belongs to the religious community itself.
The Case and the Opinion
JM was baptized in Ghent in 1955. In 2021 he asked the Diocese of Ghent (Bisdom Ghent) to delete any reference to him in its registers. The diocese noted in the margin of the register JM’s departure from the Church and struck his entry through, leaving it legible. The Belgian Data Protection Authority ordered erasure, and the Brussels Court of Appeal referred the matter to the Court of Justice.
According to the AG, a baptismal register is a filing system to which the GDPR applies. Once JM objected under GDPR Article 21(1), the diocese must show “compelling legitimate grounds” for keeping his data. The correct administration of the sacraments is such a ground in principle (para. 115), but the national court must decide whether keeping the data is necessary and whether the Church’s interest outweighs JM’s, in light of his reasons and of the impact of the diocese’s refusal on his “integrity” (para. 154). If the national court finds that the diocese has not shown compelling grounds, recording JM’s departure in the margin of the register would not suffice: the diocese would have to make the identifying data illegible, through use of “opaque stickers” or other means (para. 209).
A Question of Sacramental Discipline
I do not dispute that the GDPR applies to religious bodies; what is difficult to understand and accept is how necessity is examined. The opinion begins by recognizing that religious associations are autonomous in matters “directly related to their core ethos” (para. 7), and little is closer to that core than the record a Church keeps of its sacraments. Later, the AG asks whether losing the data would “seriously hinder” the diocese’s “spiritual mission” (para. 117), and she gives the referring court reasons to doubt it; the AG notes, for example, a returning member could prove his baptism with the letters he exchanged with the parish about the erasure (para. 127), and canon 869 allows conditional baptism in case of doubt (para. 129).
There are arguments about how the Church should organize its sacramental life. I have argued elsewhere[1] that public authorities are not competent to decide such matters: it is for each religious community to determine which data it needs for its own ends and how its records should reflect an individual’s departure from the faith. Autonomy is for religious groups what religious freedom is for individuals; it is the collective dimension of the same right.
The AG opinion does not mention the case law of the European Court of Human Rights, according to which a member who becomes disaffected with his community exercises his freedom of religion by leaving it (Fernández Martínez v. Spain, para. 128). JM left the Church, and the register now says so. Nor does the opinion draw any consequence from GDPR Article 9(2)(d), which expressly allows religious bodies to process the data of former members (para. 120).
Weighing Distress
The Church’s reasons for maintaining names on its register are the same for every person whose baptism is recorded. What varies is the applicant and the nature of their objection, as the opinion admits: the national court may draw inferences from an objection that is “poorly reasoned” or “frivolous,” while one “backed by serious moral grounds” calls for a more careful assessment (para. 134). A civil judge would thus have to grade the moral seriousness of a person’s reasons for leaving a religion, and it is hard to see how two courts, let alone two EU member states, would reach the same result.
I am also not persuaded by the harm the opinion identifies—the distress of knowing that a community goes on processing one’s data “in perpetuity, citing doctrinal tenets regarding the permanent and indissoluble nature of baptism” (para. 150). Those who have suffered within a religious community, whom the opinion acknowledges (para. 152), deserve every consideration. But the complaint is about what the Church believes, and the AG herself accepts that nobody can require the Church to treat a baptism as though it had never taken place (para. 207). A sticker over a name leaves the doctrine where it was.
The Marginal Note
As the Church argues, and as I agree, a baptismal register has never been a list of current members. Rather, it accurately records an event that occurred and remains an accurate record no matter what the person involved may later believe. The opinion responds to this argument by comparing the diocese to a service provider asked to delete a customer’s data (para. 203), a revealing comparison. The solution adopted by the Church of recording the departure in the record’s margin is already a compromise. According to the position paper of COMECE (the Commission of the Bishops’ Conferences of the European Union), this solution has been accepted by the French Conseil d’État, the Irish Data Protection Commission, and courts in Poland and Slovenia.
Not a Privilege
The European Commission argued before the Court that the balance had to be resolved in favor of the controller (here, the diocese), no matter the situation of the individual. The AG rejects this, asserting that no interest should “systematically prevail” and Article 21(1) requires the national court to consider each applicant’s particular situation (paras. 131–33). Yet the standard the AG applies would lead the data subject to prevail almost systematically since, as the CJEU has held, the controller’s grounds can succeed only exceptionally in the case of an objection (para. 105).
Importantly, a baptismal entry cannot be compared with the membership file of an association, which one joins and leaves at will. Baptism is, under the 1983 Code of Canon Law, a fact with legal effects: by it, a person is incorporated into the Church and acquires rights and duties (canon 96), and those effects are permanent. The sacrament of baptism imprints a character and cannot be repeated (canon 845, sec. 1), independent of what parties might later wish. The register records that fact of canon law, much as a civil register records a birth. And in many EU member states, civil registers too are updated by marginal annotation, never by removing the entry. The applicant’s particular situation may well bear on who has access to the entry. But it cannot bear on whether the fact is recorded.
Nor does protecting baptismal records amount to a privilege for religious bodies; it is an expression of their fundamental right to autonomy. Article 10 of the EU Charter of Fundamental Rights, read in light of Article 9 of the European Convention on Human Rights, protects religious communities as such, and Article 17 of the Treaty on the Functioning of the European Union confirms the Union’s respect for their status. In matters of doctrine, worship, and internal organization, the state has in principle no discretion to determine whether religious beliefs, or the means used to express them, are legitimate (Hasan & Chaush v. Bulgaria, para. 78). The keeping of sacramental records is part of this core right to autonomy.
For the above reasons, I hope that the Court will hold that the GDPR applies and that the diocese must record the person’s departure, restrict access to the register, and disclose nothing outside the community—but that the entry itself is not open to erasure. What the AG opinion proposes instead touches the essential content of the freedom that the European Charter guarantees to religious communities as well as to individuals.
Reference:
[1] Francisca Pérez-Madrid, La autonomía de las confesiones en materia de protección de datos en el Reglamento General de Protección de Datos (comentario al artículo 91 RGPD), in 2 COMENTARIO AL REGLAMENTO GENERAL DE PROTECCIÓN DE DATOS Y A LA LEY ORGÁNICA DE PROTECCIÓN DE DATOS PERSONALES Y GARANTÍA DE LOS DERECHOS DIGITALES 3467, 3467–79 (Antonio Troncoso Reigada ed., Civitas 2021).