Art. 10 CFR states: “Everyone has the right to freedom of thought, conscience and religion. This right includes freedom to change religion or belief and freedom, either alone or in community with others and in public or in private, to manifest religion or belief, in worship, teaching, practice and observance.” The processing of personal data by the controller may serve the realisation of this fundamental right.
This is recognised by Art. 1 II GDPR, which states that the Regulation protects the "fundamental rights of natural persons", which includes the fundamental rights of the controller [Tile CO.03] and other persons [Tile CO.04]. This is confirmed by Rec. 4 (2) GDPR:
“The right to the protection of personal data is not an absolute right; it must be […] balanced against other fundamental rights, in accordance with the principle of proportionality.” [see also Tile CO.01].
The freedom of religion is explicitly mentioned in Rec. 4 (3) GDPR:
“This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular […] freedom of thought, conscience and religion […].”
In accordance with this, the German Federal Constitutional Court states:
The right to informational self-determination “must be balanced against the freedom to gather, process and use information for one’s own purposes, including for changing purposes” [Order of 6 November 2019 - 1 BvR 16/13 -, para. 87].
This multidimensionality of fundamental rights is insufficiently recognised by the GDPR as a whole. Among the rights and freedoms of natural persons that the GDPR seeks to protect, the fundamental rights of the controller are hardly explicitly taken into account.
Religion-specific regulations can only be found in the following GDPR provisions:
Articles: 9 II d and 91 GDPR.
Recitals: 55 and 165 GDPR.
Therefore, the fundamental rights of the Charter of Fundamental Rights must be used for the interpretation of the term "rights and freedoms". If processing by the controller is necessary for the development of the freedom of thought, conscience and religion, this can be based on Art. 7 CFR.
Example: members of a religious community (Jehovah's Witnesses) collect personal data of possible interests in their door-to-door preaching activities [see ECJ, judgment of 10.7.2018 - C-25/17 -].
In addition to aforementioned GDPR provisions the principle of proportionality (Art. 52 I CFR) must be applied in order to balance the rights of the data subject and the freedom of thought, conscience and religion of the controller (see Practical Concordance, Tile P.04).