WYWH: “Data Privacy Laws in Archival Collections: Challenges in the Digital Age”

October 31, 2023

By Patrick K. Lin

On October 3, 2023, the Center for Art Law hosted Data Privacy Laws in Archival Collections: Challenges in the Digital Age to discuss some of the challenges faced by art organizations and businesses that collect, preserve, and disseminate archival collections in an ever-changing privacy law landscape. The training session was attended by legal professionals, artists, students, and researchers alike.

The session examined the delicate balance between recording the shared history and provenance of an archival collection and complying with data privacy laws as archives undergo digitization. How should personal information be treated in archival collections made available online? What must archivists do when a collector or purchaser requests that their personal data be deleted from an online archive? The guest speakers grappled with such questions and outlined best practices for achieving compliance while considering the important role of archiving art. The session was led by guest speakers Sandrine Canac and Joelys Mendez. The session was moderated by Jana Farmer, Partner at Wilson Elser and a member of the Board of Advisors at the Center for Art Law.

Sandrine is an art historian and Director of Digital Archival Projects at the Wildenstein Plattner Institute. Her scholarship has been published in journals such as Perspective and the Oxford Art Journal. Sandrine’s research on art objects produced by convicts in the French penal colony of New Caledonia will appear in the Journal of Modern Craft in 2025.

Joelys is an Associate at Wilson Elser with experience creating data privacy programs under federal and international law across several industries. She assists clients in responding to cybersecurity incidents and breaches, establishing global data privacy compliance programs, and responding to state and federal regulatory investigations. She has also worked with clients to respond to regulatory inquiries and data privacy complaints under the General Data Protection Regulation (GDPR).

Jana kicked off the session by introducing the guest speakers and sharing that many newly enacted domestic and international laws regulate personal data and information. These privacy laws create something of a perfect storm, particularly for the world of archival collections, as archivists are expected to mitigate new regulatory risks while continuing efforts to digitize works. Jana also previewed the continued relevance of intellectual property laws in archival work, particularly because digital archives make copyrights and peoples’ likenesses public.

Sandrine started her portion of the session by providing background on the important role of archival work in preserving art and history. She explained the archival standards and practices she employs in her day-to-day work, as well as how digitization and the online distribution of archival collections is affected by privacy laws, such as the GDPR in the EU and state laws in the US. For example, Sandrine elaborated on how certain privacy law principles like the right to be forgotten may have unintended consequences for archivists and historians. “Balancing the right to privacy against the work of providing access to historical records is part of the DNA of an archivist’s job,” she explained. “However, new privacy laws brought a new degree of anxiety as it could allow for the rewriting of historical records because the ability to delete part of the information may skew the way history is written.”

Sandrine also emphasized the importance of conducting a copyright analysis, regardless of whether an institution is making its archival collection available online or offline. More specifically, an institution must identify the copyright holder and, for materials not already owned by that institution, seek the copyright holder’s permission to reproduce those materials. The decision to publish those materials in an archival collection hinges on whether permission is granted or denied. However, when a copyright holder cannot be identified, an institution may be able to rely on fair use to publish the material in question, especially if the institution can demonstrate a fair use purpose, such as scholarship or research.

Before transitioning into an in-depth discussion on privacy laws and regulations, Jana highlighted the unique challenges of contemporary art. For instance, unlike traditional artworks, many contemporary artworks may be composed of degradable materials or require installation and uninstallation at each exhibition or venue. As a result, contemporary artworks require complex records in order to preserve qualities such as authenticity, marketability, and even ownership, presenting a slew of challenges for archivists while underscoring the importance of archival work.

Joelys then discussed the role of data privacy laws in archiving contemporary art, sharing a Code of Ethics developed by the Society of American Archivists, which requires archivists to acknowledge that privacy is regulated by law and that archivists should “establish procedures and policies to protect the interests of the donors, individuals, groups, and institutions whose public and private lives and activities are recorded in their holdings.” To that end, Joelys focused on disclosure obligations and data subject rights, such as the right to opt out of the sale of personal information and the right to delete personal data. She explained that many of these data subject rights are exercised through data privacy requests, providing examples of what a data request may look like as well as how to process data requests in a manner that aligns with privacy law guidelines.

Joelys concluded the session by recommending best practices in archiving, including how to sort personal information and how to implement data retention and access policies that align with legal and regulatory requirements. “The key for these laws is to minimize the amount of data collected, to only what is absolutely necessary,” she said. “A great way to start being in compliance is nipping any unnecessary data collected in the bud, in addition to creating policies for handling data subject requests.”

This session offered valuable insights into the legal considerations archivists must account for when balancing access to a collection and privacy of art purchasers and owners.

Premium Members of the Center for Art Law can view the recording and archives of the event and of past Center events.

Select Resources from the Handout and Materials

• Mette Marie Sutton and Helen Ingram, Data Protection and Art & Cultural Heritage, Collyer Bristow LLP, Lexology (Jan. 11, 2018).
• Hannah Sistrunk, The General Data Protection Regulation in Archives, The Rockefeller Archive Center (May 18, 2020).
• Zachary G. Stein, Privacy in Public Archives: Managing Personally Identifiable Information in Special Collections, RBM: A Journal of Rare Books, Manuscripts, and Cultural Heritage (2021).
• General Data Protection Regulation for Artists and Art Organisations, Art Business Info.
• Privacy Concerns in Archival Records, Margot Note Consulting LLC (Nov. 15, 2021).
• Art Law and the Art Market: Disclosure or Discretion?, Sotheby’s (Oct. 2, 2017).
• Emily Trice, What Artists and Gallerists Should Know About Data Security, Artwork Archive (July 22, 2021).

About the Author

Patrick K. Lin is the Center for Art Law’s 2023-2024 Judith Bresler Fellow and author of Machine See, Machine Do, a book about how public institutions use technology to surveil, police, and make decisions about the public, as well as the historical biases that impact that technology. Patrick is interested in legal issues that exist at the intersection of art and technology, particularly involving artificial intelligence, data privacy, and copyright law.