Many people do private genealogical research as a hobby. In order for one’s family tree to be as detailed as possible, personal data from the individual persons is necessary. Is this still permissible since the entry into force of the General Data Protection Regulation (GDPR)? We would like to answer this question with this article.
Is the GDPR applicable to private genealogy at all?
Article 2 (2c) specifies that processing by natural persons for the exercise of exclusively personal or family activities is not covered by the GDPR. Therefore, the GDPR does not apply to private genealogical research.
Recital 33 to the GDPR describes that the processing and collection of personal data for scientific purposes should be possible. However, the ethical standards of science must be observed. Recital 160 even mentions genealogy specifically:
This Regulation should also apply to the processing of personal data for historical research purposes. This should include historical research and research in the field of genealogy, although it should be noted that this regulation should not apply to deceased persons.
This ensures that the processing of personal data of deceased persons is not covered by the GDPR (deceased persons are no longer persons). For living persons, on the other hand, other considerations are to be considered advantageous. Recital 18 states that:
This Regulation shall not apply to the processing of personal data carried out by a natural person for the exercise of exclusively personal or family activities and thus without reference to a professional or economic activity. Personal or family activities could also include maintaining a correspondence or address lists or using social networks and online activities as part of such activities. However, this Regulation applies to controllers or processors who provide the tools for processing personal data for such personal or family activities.
This recital is also reflected in Article 2 of the GDPR (material scope), which states in paragraph 1:
This Regulation shall apply to the wholly or partly automated processing processing of personal data as well as to the non-automated processing of personal data stored in a file system are stored or are to be stored.
Thus, the processing of personal data of the immediate family environment is not regulated by the GDPR and thus permissible.
Genealogy in an organization
As noted above, research that goes beyond the private setting must apply the ethical standards of science. Especially for the publication of personal data (e.g. village chronicle) there are decisions of the data protection authority, which prohibit the publication of personal data.
Since the processing of personal data of immediate family members is not regulated by the General Data Protection Regulation and the processing of already deceased persons is also not covered, private genealogical research is still possible without any problems. The use of corresponding portals on the Internet is also expressly permitted by the GDPR.
Are you self-employed or have you been commissioned by your company to implement the General Data Protection Regulation? With easyGDPR, we have the right tool to make your company DSGVO-ready.