1. Where in a Member State, churches and religious associations or communities apply, at the time of entry into force of this Regulation, comprehensive rules relating to the protection of natural persons with regard to processing, such rules may continue to apply, provided that they are brought into line with this Regulation.
Article 91 GDPR - Existing data protection rules of churches and religious associations
2. Churches and religious associations which apply comprehensive rules in accordance with paragraph 1 of this Article shall be subject to the supervision of an independent supervisory authority, which may be specific, provided that it fulfils the conditions laid down in Chapter VI of this Regulation.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Where churches and religious associations or communities in a Member State applied comprehensive data protection rules at the time the Regulation entered into force, paragraph 1 allows those rules to continue to apply, provided they are brought into line with the Regulation. It preserves an existing framework rather than granting an exemption from the Regulation itself.
No. Paragraph 1 covers only rules that were already applied at the time of entry into force, which under Article 99(1) was 24 May 2016. A community without such pre-existing comprehensive rules falls under the general regime.
The continued application of church rules is conditional on their alignment with the Regulation, so the internal framework may take its own form but cannot deliver a lower level of protection. The text does not spell out a verification procedure, leaving the assessment to the supervisory arrangements of paragraph 2.
Paragraph 2 subjects them to the supervision of an independent supervisory authority, which may be a specific one, provided it fulfils the conditions laid down in Chapter VI. A dedicated church data protection authority is therefore permissible only if it meets the independence and competence requirements of Articles 51 to 54.
Yes. They are simply ordinary controllers under the Regulation, supervised by the general supervisory authority of the Member State, and cannot establish a specific authority under paragraph 2.