EU Court Advocate General: Baptismal registers are subject to the GDPR; crossing out a name does not count as erasure
Impact level
⚪ Background
What happened
On October 1, 2026, EU Court Advocate General Laila Medina issued an opinion in Case C-12/25 (Bisdom Gent VZW v. Belgian Data Protection Authority): people baptized as children may, in principle, request that the church erase their personal data from baptismal registers under Article 17(1)(c) of the GDPR, and the church must show that overriding legitimate grounds exist. Crossing out a name while keeping it identifiable and adding a note explaining departure from the church does not constitute erasure under the GDPR. The opinion is non-binding; the Court is still deliberating, and no judgment date has been set. [1]
Seller impact
- InferenceThe opinion places churches, charities, and companies alike under the GDPR. The threshold for refusing a deletion request is “overriding legitimate grounds,” rather than ordinary legitimate interests, and crossing out a name while leaving it traceable does not count as erasure. If the Court follows the opinion, it will be harder for organizations that store personal data in structured registers or archival ledgers, including membership records and customer histories, to justify keeping records available for reference. Any archival exception would need to be shown necessary and accompanied by safeguards. The opinion is not binding, and current compliance obligations remain unchanged. [1]
- InferenceThe direct impact on business operations is limited: the opinion concerns only church registers and does not address e-commerce platform rules, seller accounts, or consumer data obligations, nor does it mention any platform enforcement approach. Eurod e-commerce sellers holding ledgers of EU personal data face no new operational requirements as a result, but should note that regulators may cite the reasoning on the burden of proof for deletion requests. [1]
Suggested action
No changes to operations are needed in response to this opinion. If relevant, simply verify that your own process for deleting EU personal data can render it truly unidentifiable.
Evidence that would disprove the assessment
- Assessment 1:This assessment would no longer apply if the Court’s final judgment finds that the register is not an “archiving system” under Article 4(6) of the GDPR, or that crossing out a name and adding a note constitutes valid erasure.
- Assessment 2:Reassess if the European Data Protection Board or Belgium’s GBA issues formal guidance for businesses based on the opinion, or if regulators expand enforcement after the Court’s judgment.