Declassification and GDPR in military archives

By Kathleen Van Acker, Archivist with the section Classified Archives (Belgian Ministry of Defense).

The Committee of Military Archives thanks Kathleen Van Acker, our Secretary General, for her committment and her participation to this blog after she presented “new privacy rules and declassification“in Belgium during the 2021 CAM meeting

A topic that is always present during CAM meetings is the classification and declassification of military archives. This year we once more discussed this topic, exchanging views and practices.

It was also part of my presentation. However classified information and declassification is only one problem archivists have to deal with. In my opinion privacy can be a much more difficult topic when dealing with information in military files. Both topics were discussed in my briefing where I presented the section Classified Archives (Belgian Ministry of Defense) and our regulations and methods for dealing with classified information and personal data.

Classified information and classified archives.

Military archives contain classified information, this is a reality military archivist have to work with.

They have to walk the thin line between providing information to researchers and be careful not to break the rules on classification or give information which may endanger national security or individuals.

Does this mean that classified archives are by no means accessible to researchers? No, after all the purpose of classification is to protect information, and not to keep information away from the public. 

With the passage of time classified information can become less sensitive, and may be declassified and made public.

In Belgian law only the person who classified the document can declassify the document or give his/her permission to declassify (art.5 de la Loi relative à la classification et aux habilitations de sécurité, 11 décembre 1998) Which means that a lot of requests are send to ask for declassification. This procedure is used in “ad hoc” demands: A researchers asks for information, the archivists scan the files and if they find a classified document they evaluate whether the information is still sensible. If not, they send a request to the person, organisation (or his successor) with a demand to declassify. When they get the official permission, the documents and/or file is also officially declassified and open to the public.

A second method is used for larger archives. It treats complete archive funds that are being declassified and transferred to the War Heritage Museum or the National Archives as a whole. The most recent example is the archive fund of World War I which was declassified and transferred to the War Heritage Museum. This procedure takes a lot of time. First a detailed inventory is made of the archives, including remarks about potential sensible documents. The inventory is examined by the Commission of Archives, which gives its permission to declassify, followed by an official declassification note from the Minister of Defense.

Personal data protection.

Archivists are used to dealing with personal data protection, but for the last couple of years the protection  of those data has been under steady attention and as a result of that the protection measures have become more and more extensive. 

Since 25 May 2018 we have the GDPR or General Data Protection Regulation in the EU, a binding legislative act which must be applied across the Union. The key principle of the GDPR is data minimisation. To use the terminology in the GDPR: “Personal data should be collected and processed only if it is really necessary to do so (…) only as long as it is necessary in order to achieve the purpose for which the personal data was collected” (art.5).

Luckily the GDPR left some room for exemptions, one of them is “archiving purposes in the public interest”, or archives would no longer contain any personal data in the future.
EU lawmakers acknowledged that archives are important and even necessary to enforce fundamental and democratic rights an stated that “personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes”(art.5).

This definition can be confusing to people not dealing with this kind of information, but they can trust archives services: they will not disclose their personal data incorrectly, because:

• Archivists only select those documents for permanent preservation that are necessary for historical research or to enforce human rights;
• Storing personal data is not the same as giving access: the closure period can vary in different countries. 

Important for historical research is that the GDPR protects personal data of living persons, not the personal data of deceased persons. It seems simple, but how can archivists know that the person is deceased? They can assume that persons born more than hundred years ago are no longer alive. In cases where the 100-years mark isn’t reached, archivists can ask for a prove of decease (eg. an obituary). 

It is clear that in case of a declassification request and handling personal data, archivists will have to make case-by-case assessments. Much to the frustrations of researchers sometimes, these procedures take time and a lot of careful consideration, but I learned that informing the researchers about this way of working and the tight legislation we have to deal with, makes them understand the delays or the refusal to access in the worst case. 

---

---