GDPR impact on genealogy website / uncontrolled user data
<p>The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is mainly a hobby project (started working on it for my grandmother) but I want to make it available to the general public.  </p>

<p>Before I put way too much effort in to the website I was wondering how this project is going to be affected by the GDPR. </p>

<p>The data the user inputs is only searchable, editable and removable by the person who creates the family tree and the users that are invited to do so by the creator. Using this system (and most genealogical systems) the user is able to input data about people who are still alive and have no knowledge of this.</p>

<p>As I understand, officially the person creating the family tree should have permission to enter the data from the people that are still alive, but in practice I fear that is not always the case. </p>

<p>From what I understand of the GDPR with my limited knowledge about the subject the <code>processor</code> (in this case the website) has to ask permission from the people of which it stores the data, but who is that in this case? </p>

<p>Is it enough to ask permission from the user inputting the data and inform them that they should have permission from the persons they are entering the data of? </p>

<p>If not, I am a bit lost on how to handle the GDPR in this case, it is next to impossible to get the permission of all the living people that are being added the family trees.</p>

<h1>GDPR killing genealogy websites?</h1>

<p>I could see GDPR totally killing genealogy websites if they follow the rules strictly, but would they really want to do that. Seems to me genealogy has an important historical role. </p>

<h1>Treat living persons with anonymization</h1>

<p>I assume you don't have data to identify a person or contact the living person. How would you contact to get consent to show personal information if you only have a name, impossible right?</p>

<p>GDPR tries to stop abuse of personal data, yes, and your family tree certainly is personal data. However those who come to your website would mostly want to search and edit the non-living, search back in the history, thus the current generation follows the family tree and are not the point of entry.</p>

<p>You can provide certain anonymization to those alive by not displaying the first names in full, maybe just the first letter. You may want to hide address, spouse, children for current generation. You could make those available for view/edit first by going through a secondary login, "not a robot". 
Further you may remove living people from search results and hide from search engines so they do not have ability to index the current generation. 
That would make it harder to abuse if you're going after an individual, but at the same time doesn't lock out the people providing information.</p>

gdpr website