What information about a person are private and what are public?

Question

What information of a person I may write on my web site without special permission from that person? Lets take 'Steve Jobs', you can find a lot of websites where you can find date of birth, name, parents, biography and so on. I am sure that most of that sources do not have requested any special rights for that. However Steve Jobs without doubt is public figure. But what if I do it on my website for some person "not so" public. Where is a border? What info about a person is not personal and may be published?

Answer 1

Here are some examples from Washington state law (from RCW 9.73). Wrongfully obtain and divulging a telegraphic message by connivance with a telegraph clerk (etc.); reading (and then divulging) the contents of a sealed letter; any recording made without consent plus divulging same. Actually, there are not so many such restrictions. There is a Public Records Act, which, contrarily, requires that some information be made available. In 1956, according to the attorney general, signatures on voter petitions are not public records. More recently, according to SCOTUS, they are public records (the law changed in the intervening half-century). In general, anything that is subject to the records law is completely publishable. There are various limits on what information from public records is not supposed to be divulged, for example RCW 42.56.050

A person's "right to privacy," "right of privacy," "privacy," or "personal privacy," as these terms are used in this chapter, is invaded or violated only if disclosure of information about the person: (1) Would be highly offensive to a reasonable person, and (2) is not of legitimate concern to the public. The provisions of this chapter dealing with the right to privacy in certain public records do not create any right of privacy beyond those rights that are specified in this chapter as express exemptions from the public's right to inspect, examine, or copy public records.

Social security numbers enjoy a certain level of heightened protection, depending on the state and the act. Washington has a chapter on Identity Crimes, which includes a prohibition against improperly obtaining financial information (which is defined broadly to include SS numbers, passwords, and so on), but the law does not cover "stumbling onto" information, and also does not criminalize publishing information. Washington does not have a law prohibiting publishing an SS number, but California does.

As for your specific list, as far as I know it is never illegal or civilly problematic to publish a person's name, parents' names, (ordinary) biography; nor is date of birth taken to be protected in any way, although DOB is widely used in connection with identity confirmation.

There is a common law tradition of recognizing the "right of privacy", and there is a tort "public disclosure of private fact". An important element of that tort is that the information is offensive to a reasonable person: a reasonable person probably would not be offended by someone publishing their birthday, but perhaps some juries have found publishing such information to be offensive.

Because of the 1st Amendment, you have the right to publish stuff unless there is a compelling state interest in you not doing so.

Answer 2

If your use of this data is purely in a non-commercial capacity (i.e. nothing to do with your employment whether for a company or self-employed) then you would probably be exempt from GDPR, however if it relates to any commercial purpose...

If you are based within the European Union (EU) or store data about individuals (they may be your customers) located within the EU (living/working/travelling etc) then the General Data Protection Regulation will apply to you from May 25th 2018.

1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

(GDPR, Article 3: Territorial Scope)

Additionally, since GDPR also covers the supply chain with regard to storing or processing personal data, though data processors have slightly different responsibilities. If you were required to comply you may also have to update contracts and policies, produce documentation, and possibly change your hosting provider to one that is GDPR-compliant if your current provider is not.

With regard to the boundary of what you could publish, the GDPR definition of 'personal data' is as follows:

For the purposes of this Regulation: (1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(GDPR, Article 4(1): Definitions)

With this in mind, if the information is about an individual, and you are subject to GDPR then not only can you not publish personal data without genuine consent or a legitimate interest (e.g they are a customer under contract), but you can't collect, store or process it either (including on paper).