2

My extended family is rather large, and I would like to make a family tree. Given the nature of the data I'll have a lot of peoples personal data. Preferably their immediate family relations, name, a picture, DOB, phone number, email address, Facebook link. And potentially more.

Some of this information I know just because they're my family, I wouldn't have been given GDPR consent when I was a child first meeting them. This would be things like their name and who they're related to. After this I know some DOBs for similar reasons. I can get phone numbers from our family chat. I can get a picture and some additional information from Facebook. Etc.

Given that all of this information is almost definitely protected by GDPR could I legally make a family tree?

What if:

  • The family tree is strictly for myself.

  • The family tree can only be seen by people in that tree. And they can only see people they're blood/adopted relatives of, and people married into the tree.

    To be clear my fathers side could see my mother, but not her side of the family. I can see both sides, as I'm blood related to both.

  • What if I want to be able to include more than just the two families?

    Say one of my cousins are in a similar situation and wants to include both their sides of the family.

Improve this question

1 Answer 1

Reset to default
3

The GDPR has an exemption for purely personal or household activity. Creating a family tree seems purely personal as long as you don't publish it. You're also allowed to freely share the tree as long as it stays within that purely personal scope. Your proposed restriction of only showing data of blood relatives seems excessively strict.

But assuming that this exemption wouldn't apply, there'd probably still be no problem. The GDPR does not require you to always obtain consent. It requires that the purposes for which you process personal data are covered by some legal basis. Consent is one such legal basis, but legitimate interest is another.

  • You can likely argue that you have a legitimate interest to create a tree of your (extended) family.
  • The legitimate interest must be weighed against the rights and freedoms of the affected persons. For example, contact information could be used for stalking.
  • The balance of the legitimate interest check can be changed if you adopt suitable safeguards. Your idea of only sharing data with close relatives would be such a safeguard, but it might not be necessary.
  • When you rely on legitimate interest, the affected person can object to further processing, furthermore they can request to be erased from your records.
    • A request for erasure can be denied if there are overriding grounds to keep the data. E.g maybe only contact information has to be deleted but names, dates, and relations might be kept.
  • You should notify persons when they are included into your records.
  • It is your obligation as the data controller to make these decisions. If someone disagrees they can sue you or lodge a complaint with a supervision authority.

Note that dead persons are not natural persons in the sense of the GDPR, and have no privacy. However, national laws may provide such protections.

Improve this answer
2
  • I'm checking I understand you correctly, the first paragraph is purely if it's for personal use. The rest is if I were to say make it a website, and provide access to it for people? That would make sense, and it seems reasonable.
    – user15344
    Aug 29, 2019 at 0:57
  • 1
    @EthanOwens The first paragraph explains that you likely have no GDPR obligations. The rest discusses what you'd have to do if your use doesn't fall under the purely personal activity exemption. Publishing the tree on the website would be an example of that, but careful: I doubt you would have a legitimate interest to publish info about living family members. For a public website you might indeed have to collect consent. In my family the database is maintained digitally but it is only shared via printouts.
    – amon
    Aug 29, 2019 at 6:00

You must log in to answer this question.