5

The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is mainly a hobby project (started working on it for my grandmother) but I want to make it available to the general public.

Before I put way too much effort in to the website I was wondering how this project is going to be affected by the GDPR.

The data the user inputs is only searchable, editable and removable by the person who creates the family tree and the users that are invited to do so by the creator. Using this system (and most genealogical systems) the user is able to input data about people who are still alive and have no knowledge of this.

As I understand, officially the person creating the family tree should have permission to enter the data from the people that are still alive, but in practice I fear that is not always the case.

From what I understand of the GDPR with my limited knowledge about the subject the processor (in this case the website) has to ask permission from the people of which it stores the data, but who is that in this case?

Is it enough to ask permission from the user inputting the data and inform them that they should have permission from the persons they are entering the data of?

If not, I am a bit lost on how to handle the GDPR in this case, it is next to impossible to get the permission of all the living people that are being added the family trees.

Improve this question

1 Answer 1

Reset to default
3

GDPR killing genealogy websites?

I could see GDPR totally killing genealogy websites if they follow the rules strictly, but would they really want to do that. Seems to me genealogy has an important historical role.

Treat living persons with anonymization

I assume you don't have data to identify a person or contact the living person. How would you contact to get consent to show personal information if you only have a name, impossible right?

GDPR tries to stop abuse of personal data, yes, and your family tree certainly is personal data. However those who come to your website would mostly want to search and edit the non-living, search back in the history, thus the current generation follows the family tree and are not the point of entry.

You can provide certain anonymization to those alive by not displaying the first names in full, maybe just the first letter. You may want to hide address, spouse, children for current generation. You could make those available for view/edit first by going through a secondary login, "not a robot". Further you may remove living people from search results and hide from search engines so they do not have ability to index the current generation. That would make it harder to abuse if you're going after an individual, but at the same time doesn't lock out the people providing information.

Improve this answer
8
  • 1
    Thank you for the reply, it's hard to find a reliable source on how the GDPR will handle cases like this, I guess it is a wait-and-see game. On the part of the anonymization, initially the plan is to only have the user be able to see the data he/she entered. It would seem ridiculous to me if it would be the site's responsibility to get permission from all the living persons in the family tree, while trying to have as little access to the data as possible. But then again, it is the EU.
    – Thizzer
    Apr 24, 2018 at 8:25
  • 1
    I also wonder how the right-to-be-forgotten should be handled in a situation like this. If Person A writes information about Person B in a family tree managed by/only visible to Person A. Should Person B then be able to remove his/her information from Person A's family tree?
    – Thizzer
    Apr 24, 2018 at 8:32
  • 1
    But what if the request is made by a random person just saying; "I don't want to be in any family tree of any user on your website". Then I'd have to search all family trees for a possible match and remove them. That is impossible to execute right?
    – Thizzer
    Apr 24, 2018 at 10:28
  • 2
    Article 89 talks about historical and scientific processing.privacy-regulation.eu/en/…
    – Paul
    Apr 28, 2018 at 6:15
  • 1
    @Thys I'm not a lawyer. If you have to participate in legal proceedings to make the historical or scientific claim it may not help much. GDPR seems like a small part of a crap sandwich for small entrepreneurs, that includes trying to force foreigners to obey other eu laws as well. I'm not a lawyer, so can't advise what you should do.
    – Paul
    May 7, 2018 at 19:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .