General Data Protection Regulation and Oral History

Verena Naegel's picture

Dear Community,

I would like to start a conversation about the impact of the EU General Data Protection Regulation (GDPR) on Oral History interviews. Maybe we can learn from each other.

I would like to ask for your thoughts about the impact of the new provisions and requirements pertaining to the processing of personal data of individuals on our work.

Did anyone update their consent forms to make them compliant with the GDPR? What had to be changed or added specifically?

What has to be considered when an online published Oral History interview contains names of third parties (e.g. the names of family members or acquaintances of interviewees)?

We had a case, in which the son of an interviewee, asked us to remove the transcribed testimony of his father from the internet, because his name was mentioned and also indexed. He referred to the new GDPR. We took the interview out of the www, although the interviewee agreed to the publication of his testimony in the 1990ies

 

Looking forward to your input

Thanks

Verena

Hi Verena,

This is something we've been thinking about a lot at the British Library and we have written this guide (still a work in progress) for the Oral History Society website: http://www.ohs.org.uk/advice/data-protection/

In terms of forms we now recommend a Participation Agreement prior to the start of the interview so that the project/archive/etc has a legal basis to process data during the interview progress, and a recording agreement after the interview to cover copyright and access conditions. Importantly, we recommend that people don't call this a consent form because consent is now a legal basis by which you can process data but it is much better to use the 'Archiving in the Public Interest' exemption. This doesn't meant to throw out all our notions of informed consent but to recognize that consent now has a legal as well as a theoretical definition and we need to avoid the former. There are examples of these forms in the linkI posted above.

In terms of third parties mentions like the individual you described who asked you to remove a transcript, they can only do this under GDPR if they can show that you are releasing 'sensitive personal data' that could cause 'substantial damage or distress'. What substantial damage or distress means is still not clear but according to the Information Commissioner's Office it is:

* Financial loss
* Physical harm
* A level of upset or emotional or mental pain that goes beyond annoyance, irritation, strong dislike, or a feeling that the data’s release is morally abhorrent

However, until a case has been successfully made we won't have an examples of what this looks like in practice. We are just trying not to be the first example!

The case you mentioned is a very tricky one because you are balancing the rights of individuals under GDPR with the original intentions of interviewees and I know that none of us want to start feeling like we are retrospectively censoring people. Our general policy is that if we required we will try to negotiate specific closures (mutes) for specific period of time and not to close interviews entirely, but this can be very labour intensive. There is also the question of whether we should approach online and on-site access differently. Is the transcript in question still available for on-site access? Can the interview itself be listened to online?

Anyway hope this is of some help and looking forward to discussing this further.

Best,

Charlie Morgan
Oral History Archivist