Before a request for total deletion of data, a proportional judgment must be made against the right of conservation.
Article previously published in Spanish on Confilegal by Irene Casanueva on March 13, 2021
A religious group has the right to keep personal data of a person who leaves the religion when it is necessary for religious purposes. But can all of it be kept?
Before a request for total deletion of personal data, in the terms of Article 9.2(d) of the General Data Protection Regulation (GDPR), the specific data to which the right of conservation affects are those that, in each case, exceed the proportionality judgment that requires the fulfillment of three conditions in the strictest sense: suitability, necessity and proportionality.
This is what the Supreme Court of Spain established in a recent judgment in setting jurisprudential doctrine on this matter.
The Third Section of the Chamber of Administrative Litigation in Case 244/2021, February 22, rejected the appeal filed by the religious organization of Jehovah’s Christian Witnesses against the decision of May 24, 2019, issued by the National High Court.
In addition, it confirmed that the treatment of the data is limited to use only when the affected person makes a request for re-entry, as indicated by the Spanish Agency for Data Protection (AEPD) in its resolution.
The conflict, which has now been resolved by the Supreme Court, originated in June 2017 when an individual, having left the religion, exercised her right of deletion against the religious group.
In July 2017, the religious entity partially denied the right of deletion, understanding that there was a legitimate interest in the preservation of certain personal data of former members. For example, in cases of re-admittance, they had to meet different requirements than new entrants.
Thus, it informed the claimant that it kept the following data: name of the congregation, name of the expelled person, date of birth, sex, date of baptism, and date of expulsion.
Given this response, she filed a claim for protection of rights before the AEPD, which issued a decision in January 2018 partially upholding the claim.
The Jehovah’s Christian Witnesses religious group filed an appeal for reversal against the AEPD’s decision. It was dismissed by a further decision of the AEPD in June 2018.
For this reason, the organization pursued an administrative litigation appeal before the National Court. It was also rejected before reaching the Supreme Court on appeal.
In this case, the fundamental right to data protection confronted religious freedom
The AEPD and the National Court limited the preservation of personal data to the following three items: full name of the expelled person, date of baptism, and date of expulsion.
Although it agreed with the decision by AEPD and the National Court, it pursued this case to the Supreme Court because the Jehovah’s Witnesses was defending its legitimate interest to also preserve the name of the congregation, date of birth, and sex.
In addition, the discrepancy between the parties also extended to the limitation included in the resolution of the AEPD. It established that data subject conservation may only be used in the exclusive event that there is a request for re-entry by the affected party. The religious group also opposed this limitation.
Ultimately, as stated in the judgment, the fundamental right to data protection in article 18.4 of the Constitution (CE) was confronted with the fundamental right to freedom of religion and worship in article 16.1 CE.
The court, made up of Eduardo Espín Templado (President), José Manuel Bandrés Sánchez-Cruzat, Eduardo Calvo Rojas, María Isabel Perelló Doménech, José María del Riego Valledor (Speaker), Diego Córdoba Castroverde and Fernando Román García, in its judgment, recalled that GDPR calls for the principle of proportionality as the key element in seeking a balanced solution in cases of conflict.
“Name and surname is the ideal and necessary information to identify who has ceased to be a member”
The Chamber agreed with the National Court in the sense that a religious group’s preservation of former members’ personal data, on which the appeal is focused, “does not exceed the proportionately judgement”, taking into account the conservation of personal data that was accepted in the AEPD decision.
The Chamber explained that the name and surname, which has been allowed to be kept, “is the ideal data necessary for the identification of one who has ceased to be a member of the religious group in the event of eventual or uncertain request for readmission”.
In relation to what was argued by the religion, the Supreme Court clarified that “the combination of the proper name and the surnames of the former members are sufficient in this case, by themselves, for their identification in the event one requests readmission into the religious group”.
Of course, it added, sometimes “the requirement for date of birth data may be needed where name and surname do not fully identify the data subject”, something that did not happen in this specific case.
It also rejected the preservation of personal data for use other than that limited for a request for re-entry by the affected party.
The religious group alleged a legitimate interest in using the personal data for purposes other than readmission. However, the Supreme Court added, “the truth is, the appellant does not specify any other activity or specific purpose in their filing that justifies the extension of the data processing beyond that estimated in accordance with the law by the decision of the AEPD, and contested judgment.”
For all these reasons, it declared that the appeal cannot be upheld and established as a jurisprudential doctrine that a religious group has the right to preserve personal data of a person who leaves the religion that is necessary for its religious purposes. It added that before a request for total deletion of personal data can be processed, a proportionality judgment must be carried out to determine which ones exceed it and can be kept.