Berliner Beauftragte für Datenschutz und Informationssicherheit – Court Ruling (Germany, 2022)

In November 2019, the church tax office (controller) sent the data subjects questionnaires to provide information on the religious affiliation of their two minor children. In December 2019, the data subjects requested the controller to refrain from such requests. Nevertheless, the controller requested the data subjects to complete the forms again in January 2020. Consequently, in August 2020, the data subjects filed a complaint with the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationssicherheit). They claimed that the questionnaire was unlawful under data protection law. The DPA dismissed the complaint, arguing mainly that it was not competent to decide on the matter because of the church's special competence. Furthermore it did not find a breach of data protection law. Before the court, the data subjects pursued their claim. The Administrative Court of Berlin dismissed the data subjects' claim. The court agreed with the DPA that it had rightfully declared itself incompetent in the matter. First, it held that church data protection such as in the case is subject to church supervision and not to state supervision. According to Article 91(2) GDPR, churches are entitled to establish their own independent supervisory authorities. While the wording of the provision does not clearly state whether such authority must be of an official nature or independent, the court interpreted the provision based on its systematic nature. As Article 91(2) GDPR explicitly mentions that the specific supervisory authority must fulfill the conditions of Chapter VI of the GDPR, such reference would be redundant if only state authorities were allowed since such authorities have to fulfill these regulations in any case. This position is also supported by Recital 128 GDPR. Therefore, the court found the independent nature of the church supervisory authorities to be GDPR-compliant. Second, it clarified that church data protection law must be understood as a comprehensive data protection rule within the meaning of the GDPR. According to Article 91(1) GDPR, churches may apply their own comprehensive rules relating data protection if they are in line with the GDPR. The court saw that compliance was sufficiently given in the data protection laws of the two big Christian churches in Germany. Third, the court dismissed the argument of the data subjects that the church supervisory is only competent for members of the respective religious community and that for non-members the state authorities are competent. It underlined that the competence of the church supervisory authority is only dependent on the fact that a church institution has acted and that Article 91(1) GDPR does not establish any additional requirements like the data subjects being members of the respective religious community. In a last step, the court found that the DPA did indeed have no obligation to further investigate the case. Also, its decision had been correct as the court could not find a data protection violation by the controller because the information requested by the questionnaire was necessary for the controller to fulfill their obligations for church taxing purposes.