The GDPR (General Data Protection Regulation) came into force in 2018. It imposes a legal framework on personal data protection for Europe.
It involves informing people if information about them is kept, what is done with it, obtaining their consent and allowing them to have it deleted. This regulation therefore applies to websites, which must meet this information obligation, particularly if they use “cookies”.
Does the GDPR apply to genealogy data?
The RGPD does not concern unpublished genealogy research work, for example information that is stored and processed in a genealogy application on your computer (and not otherwise published).
The RGPD applies to data present on websites publishing information about people’s civil states and lives, whether these sites are public, community or private. You are therefore affected if you use these sites to publish your own work, since if you publish information it is so that it can be consulted by others.
In the case of living people, you need to ensure that they have given their consent, and respect their right to have their data deleted.
Information on deceased persons is not concerned by the RGPD (Cf. article 27) but the RGPD introduces the obligation to delete information relating to deceased persons and limits in time the retention period of information.
Wasn’t French law already sufficient?
In France, data relating to genealogy is already protected.
The time limit for access to archives is 75 years for civil status data and 50 years for medical data (if the date of birth is known, otherwise the time limit is extended to 120 years).
Before this deadline, local civil registry offices must not disclose information on direct ancestors without proof of parentage. After this period, registers may be consulted at least in municipal or departmental archives.
The CNIL specifies that marginal notes present on records concerning individuals that have become communicable must not appear within 100 years of the closure of birth records.
What best practices can help you avoid mistakes?
It’s hard to find your way around these sometimes contradictory texts when it comes to genealogical research. Here are some best practices to follow :
- Do not publish information about living people. If the site uses GEDCOM files to publish your data, filter out living people before sending the GEDCOM file to the site.
- Only publish information relating to people’s civil status, i.e. dates and places of birth, baptism, marriage, death, burial…. Avoid publishing information relating to private life: cohabitation, employment, political activities, etc…
- Check that these sites have – at the very least – a means of automatically masking the identities of living (or recently deceased) persons and those marked “confidential” (in some genealogy software).
- Cite your sources if you publish copies (scans) of deeds or personal documents. The author or beneficiary (administrator) must appear.
- Respect the notices displayed on sites where you have found information. Cite the URLs concerned.
- For photos or copies of registers of civil status, indicate precisely the identification of the register and its place of deposit.
- Make sure you have the option of removing your data from the site. The “voluntary” publication of data often means you lose the right to dispose of it afterwards…
- Make sure that the site does not use this data for other purposes without informing you. Some sites sell certain information via affiliated sites.
This article is part of our series on Questions (and answers) for the genealogist.
Subscribe to our newsletter and receive a free article from this series every month.
