What information should or can I publish to a web site?

Question

My aunt has collected a pile of family history going way back. She asked me to help her get it in a form which we can share via the internet. I wrote a Silverlight app which works fine and is restricted to invited persons only.

One thing that I am concerned with is privacy. I just published all the info I received - birth date, middle names etc. Since then I wondered if that is a reasonable thing to do.

Should I hide certain info for living people? I know it's family but some members don't like having their details on the internet even when it is password-protected.

Is there any relevant legislation?

Answer 1

A quick, short and "dirty" answer is:

1) If the person is alive, just name and birth date, just mm/yyyy or even yyyy

2) If the person is recently deceased, everything but SSN, Drivers Licenses, Phone numbers or anything that could be actively in use by a living family member

3) If the person is deceased for a generation or two all the information you have

• Remember the more information you post the more likely others will find it useful. Also the more likely those people can help you fill in missing information.

• No matter if a person is deceased or not, never post anything you wouldn't want your worst enemy to get ahold of.

Answer 2

The answer will be different depending on the country your webserver is in. It may also vary by the country of residence of you or a person mentioned, and by the country the site is being accessed from. So, in short, there are no easy answers!

The European Union, Canada, and Mexico (among others) have privacy laws that protect the personal information (such as birth date) of living people - the US is way behind the rest of the world for this.

The general rule in most countries is simply don't publish information that would identify a living person without their permission (there may be fines for ignoring this). Some countries require that permission to be given in advance in writing, in a specific form.

Even storing (rather than publishing) personal information requires registration as a "data controller" in some countries, but there's normally an exemption for "personal" use (when storing, not for publishing).

Password protecting helps, but just look at the "private" photos on sites like Ancestry to see what happens - somebody shares their "private" data with a relative, and that relative then publishes it online without any privacy at all.

Even with a passworded site, you're releasing the data to a group of people who may not have the slightest clue they should keep it private.

Personally I would not publish any information on a living person that would identify them - so maybe "private" and a birth year, to show somebody exists, but nothing more.

Answer 3

I do not believe in publishing all your data to your website.

I think you want to publish only summary information about the ancestral lines you're searching, the family names and places they come from. And list a few of the roadblocks you've encountered that you're trying to find.

The goal is to get someone to enter the family name they are researching in Google and for your website to come up in the search results. They'll go to your website and be able to evaluate if they think they might be related. If so, they'll contact you and you'll be able to cooperatively share data and learn from each other like two family researchers should.

You want to get possible relatives to contact you. You don't want them to find your data, take your data, and never be heard from again.

I've used this strategy on my personal web site. Over 15 years, I've had about 300 contacts from various people. About 50 of those turned out to be relations (many I didn't know of before) and 20 had done extensive research on their sides who I started sharing with.

Answer 4

Well, even if something is password protected, it's never going to be secure. First, there are hackers; that's the obvious threat. But the other issue is that many nontechnical people tend to use the same, dictionary-based password in many places, including email and banking websites.

In addition to that, some of this information in the family history could very well be the answer to someone's secret password reset question on one of these sites, and someone looking to capitalize on your relatives' bank accounts could conceivably use this information to their advantage.

There are laws about how businesses must treat certain sensitive data. For instance, an ecommerce retailer could be liable for storing credit card information that somehow gets into the wrong hands; however, this may not apply to you since you're not operating a business. That's not to say you couldn't be sued for negligence. I'd really advise speaking to an attorney about legal aspects, since none of us here are really qualified to give legal advice. ;)

At least with the SAAS (software as a service) providers, you know there are more people involved in maintaining the system than just you, but even then there's no guarantee that those developers are taking security of your data seriously.

The most secure data on computers is on those which are not connected to the Internet, so if this is really something that you're concerned about, you may want to consider using something that's not online.

Answer 5

In addition to everything already said here, I'd like to share my personal bad experience on this matter. After collecting some family information, I have carefully chosen a place to publish it on the web (SSL, password protected and editor invite-only). Other family members liked and supported it, until a cousin of my grandfather saw it. For some reason, in his part of the family sharing this kind of information was considered dangerous (historic reasons, some bad experience in the ex-USSR). As the result, though, because of this, I had very little information about him, he did not like even being mentioned in this form.

Basically, any information, which is connectible to living people, can be useful for 3rd parties. Therefore I would consider it safe to publish information about deceased people (still, password protected without invited people having the rights to share it), but otherwise be very careful and better talk to your family members, to get their OK.

Answer 6

My preference is to err on the side of maintaining privacy and security for living individuals. I therefore only show their places (gender and birth year only, no names, no other data at all) in the family tree; this includes individuals born within the last 100 years whom I do not know to be dead.

In addition, I do not publish any details at all -- not even their existence -- for individuals born from 1930 onwards. In my case, 1930 is a date chosen to exclude completely from publication all of my generation and the generations following, whether they are living or dead, but to allow me to publish information about my (deceased) parents. If I came from a longer-lived family, I would push the year chosen as the cut-off further back.

For individuals who are deceased and who were born before 1930, I publish all the data I have available, if it came from publicly accessible sources or (for information that came from private sources, such as family oral history) if I have explicit permission to publish it. And I would not censor any information I have discovered, even if I was asked to do so.

The only living individuals who I mention on my website are other researchers who I am thanking by name (again, if I have their explicit permission to mention them).

I don't password protect the data I do publish, as I want people to find it and because (as I've said) it's all publicly available or published by permission.

I should add that I'm in the UK.

Answer 7

In the UK, the Data Protection Act applies to information stored on living people. Those who process such data are obliged to register as a data controller with the ICO. I think it would be unethical to publish information without the individual's consent.