...does a religious org have the right to hold confidential info on one of its members
Yes, especially if the members consent to it. Remember the big YES! that JWs yell when they get baptized? That's consent.
Aside from the political debate over religion's phony, faulty argument wanting to be an exception to do whatever they want, the problem with religious organizations getting away with violating the rights regarding information about their members (and many others) is not the legality of it, nor is it whether they have the right (legal or moral) to do so. It's that they convince people to accept and submit themselves to that voluntarily. People abide what the religious organization (or rather, their leadership) tell them without questioning.