Data
protection at the Arolsen Archives

What’s special about the Arolsen Archives’ collection from a data protection perspective?

What’s special about the collection of the Arolsen Archives ­ formerly the International Tracing Service (ITS) – is the sheer volume of personal data it holds. The 30 million original documents and over 110 million database objects also contain a lot of sensitive data.

A large part of the Arolsen Archives’ collection has been published in the online archive since 2019. On one hand, this is a great opportunity to provide the general public with access to as much information as possible about Nazi persecution and its consequences. On the other hand, it presents a real challenge from the point of view of data protection.

Why does the collection contain so much personal data?

In the decades since the end of the war, the ITS has collected data and information on around 17.5 million people. Initially, the primary task of the ITS was to clarify the fates of people who had been persecuted by the Nazi regime.

The documents detailing the crimes of the perpetrators played an essential part in this work. These written records came from concentration and extermination camps, as well as from German authorities and companies. In addition, the archive contains documents that provide information on what happened to people who survived concentration camps and forced labor once the war had ended.

The Arolsen Archives still receive over 20,000 inquiries annually. Through the years, just under three million case files, known as T/D files (Tracing/Documentation), have been created to document the research conducted in response to these inquiries. This information, too, is now of great historical value.

Does this mean that the collection of the Arolsen Archives mainly consists of historical records to which data protection regulations only apply to a limited extent?

Yes and no. The holdings of the Arolsen Archives primarily consist of historical records that date back to the period leading up to 1945 and the immediate post-war period. Only in exceptional cases does a closure period or any restriction on the use of this data still apply. That’s explained more precisely in our data protection regulations.

However, in addition to historical information about the person being searched for, T/D files also contain data about the person now submitting the inquiry, much of which is subject to data protection regulations. Around two thirds of the inquiries we receive come from children, grandchildren, and great-grandchildren requesting information about the fate of their relatives, most of whom are deceased. However, researchers, students, pupils, and media professionals also send us inquiries, use our online services, and support our indexing campaign #everynamecounts. All of these activities generate data that has to be treated very differently than the data from the historical collections.

Which data protection regulations apply to the Arolsen Archives?

The Arolsen Archives operate within the legal framework established by the Berlin Agreement of December 9, 2011. This agreement granted access to the ITS archive for the purposes of research, remembrance, and commemoration. As an international organization, the Arolsen Archives have had their own data protection regulations since 2022.

Does the personal data in the holdings of the Arolsen Archives fall under the General Data Protection Regulation (GDPR)?

No. When the General Data Protection Regulation came into effect in 2018, the International Commission, the supervisory body of the Arolsen Archives, conducted a thorough review and came to the conclusion that the Arolsen Archives are not subject to the GDPR because of their status as an international organization. The Arolsen Archives drew up their own data protection regulations instead. And they established an independent supervisory body, the Data Protection Board, to monitor compliance.

As we mentioned before, the Arolsen Archives launched their online archive in 2019. What risks and opportunities were considered in advance?

On one hand, there was the goal to make as many documents as possible accessible worldwide. On the other hand, there were concerns about potential privacy violations and data misuse if the documents were readily available online.

After carefully weighing our options, the International Commission decided it should be possible to access the documents using modern methods, i.e. the documents should be available online. That’s why we’re now in this extraordinary situation where almost 40 million documents are accessible online.

Did anyone object when the documents were made available on the internet, and are there still objections today?

Very rarely. Per year we only receive a handful of requests asking us to take down certain documents. This often has to do with the personal data of living relatives of victims of Nazi persecution which may be contained in the documents. And some people don’t want individual documents about their parents to be searchable online. We carefully review each of these requests.

However, no data is ever deleted; rather it’s simply taken offline if we decide there is a legitimate reason to do so. The rules according to which we make this decision were developed in consultation with the Data Protection Board and can be viewed on our website.

Do you correct errors in documents if asked to?

Only when the mistake was clearly made by us will we correct it – if we typed in the wrong year, for example. However, we don’t correct any mistakes that are already contained in the historical documents and therefore exist in a specific context. Sometimes victims of Nazi persecution would give a false birthdate or falsify other personal information during registration at a camp – doing that could save your life. Sometimes names were spelled incorrectly. We don’t correct these historical mistakes.

What’s your personal opinion about the fact that a large part of the collection is available online?

As a historian, I obviously want the widest possible access, and I think the decision made by the International Commission was revolutionary. Without it, we wouldn’t have such a broad understanding of the Shoah, the suffering of forced laborers, or the history of Nazi persecution. Millions of names have been madevisible again; these people’s fates can now be researched. In addition, the online archive functions as accessible proof of Nazi crimes, a bulwark against denial and trivialization.

But as Data Protection Officer, I always have to ask myself what risks come with online publication? In what ways could the personal data be misused? Even though most of the historical documents are no longer subject to data protection laws, we weigh the risks and rewards of any new function we add to
the online archive – filter functions, are one example.