Many people do private genealogical research as a hobby. In order to make your family tree as detailed as possible, personal data of the individual persons are necessary. Is this still permissible since the entry into force of the data protection basic regulation GDPR. We would like to answer this question with this article.
Is the GDPR applicable to private genealogical research at all?
Article 2 (2c) states that processing operations carried out by natural persons for the sole purpose of carrying out personal or family activities are not covered by the GDPR. The GDPR therefore does not apply to private genealogical research.
Recital 33 to the GDPR describes that the processing and collection of personal data for scientific purposes should be possible. However, the ethical standards of science must be adhered to. Recital 160 even mentions genealogical research separately:
This Regulation should also apply to the processing of personal data for historical research purposes. This should include historical research and research in the field of genealogy, noting that this Regulation should not apply to deceased persons.
This ensures that the processing of personal data of deceased persons is not covered by the GDPR (deceased persons are no longer persons). For living persons, on the other hand, other recitals are to be regarded as advantageous. Recital 13, for example, states:
This Regulation shall not apply to the processing of personal data carried out by a natural person for the sole purpose of carrying out personal or family activities and thus without reference to any professional or economic activity. The maintenance of correspondence or lists of addresses or the use of social networks and on-line activities in connection with such activities could also be regarded as personal or family activities. However, this Regulation shall apply to those data controllers or processors providing the tools for processing personal data for such personal or family activities.
This recital is also reflected in Article 2 of the GDPR (material scope), which states in paragraph 1:
This Regulation shall apply to the wholly or partly automated processing of personal data and to the non-automated processing of personal data stored or intended to be stored in a file system.
Thus, the processing of personal data of the immediate family environment is not regulated by the GDPR and is therefore permissible.
Genealogy in an organization
As mentioned above, research that goes beyond the private environment must apply the ethical standards of science. Especially for the publication of personal data (e.g. village chronicle) there are decisions of the data protection authority prohibiting the publication of personal data.
Since the processing of personal data of immediate family members is not regulated by the basic data protection regulation and the processing of persons who have already died is also not covered, private genealogical research will continue to be possible without any problems. The GDPR also expressly permits the use of corresponding portals on the Internet.
Are you self-employed or have you been commissioned by your company to implement the Basic Data Protection Regulation? With easyGDPR we have the right tool to for your company.