CJEU Rules Physical Church Baptismal Registers Fall Under GDPR
The CJEU Advocate General's opinion confirms that GDPR applies not only to digital systems but also to manual filing systems, including physical records like church baptismal registers, as long as they are structured to allow retrieval of personal data. This ruling matters because many organizations assume GDPR obligations are limited to electronic data processing, leaving physical records ungoverned and non-compliant. The opinion also clarifies the right to erasure in non-digital contexts, requiring organizations to consider what 'erasure' meaningfully looks like when deletion of a physical record is not straightforward. Exceptions for archiving and historical research add nuance, but do not exempt organizations from establishing lawful bases and documented justifications for retaining such data.
Tactical Insight
Immediate actions
- Audit all manual and physical filing systems to determine whether they constitute GDPR-covered filing systems under the structured retrieval test.
- Review existing privacy notices and data subject rights procedures to ensure they explicitly cover physical and manual records, not just digital ones.
Long-term improvements
- Establish a formal Data Protection Impact Assessment (DPIA) process that includes physical record systems, registers, and archives.
- Define and document a clear organizational policy for handling right-to-erasure requests against physical records, including partial redaction or annotation procedures.
- Train records managers, archivists, and administrative staff on GDPR obligations applicable to non-digital data processing.
Detection & Compliance measures
- Maintain a comprehensive Record of Processing Activities (RoPA) that inventories both digital and physical data processing activities.
- Schedule periodic compliance reviews to incorporate evolving CJEU and national supervisory authority guidance on manual filing systems.