Only publish a personal story on your website with the explicit consent of the person it is about, and remove the story as soon as that person asks you to. For an LGBTQ+ organisation this is a legal requirement as well as a matter of safety, as a story that reveals someone’s sexual orientation can out that person to their family, employer or community.
What does the GDPR say about personal stories?
Under the General Data Protection Regulation (GDPR), data concerning a person’s sexual orientation or sex life belongs to the special categories of personal data. Processing these data is prohibited, unless one of a limited number of exceptions applies. For publishing a story, the exception an organisation can usually rely on is the explicit consent of the person concerned, given for a specified purpose.
Associations and foundations may process the data of their own members for their activities without this consent, but only within the organisation. Publishing those data on a website is not covered by that exception.
The Court of Justice of the European Union ruled in 2022 that data which reveal a person’s sexual orientation indirectly are also special category data. A story that mentions the name of a same-sex partner therefore needs the same consent as a story about coming out. The same care applies to stories about gender identity.
How do you ask for consent to publish a story?
Ask for consent in writing before you publish anything, for example with a short form. The form should state where the story will appear, whether the person’s name and photograph will be shown, and how the person can withdraw their consent. Ask for each channel separately, as someone may be happy to appear in your newsletter but not on your public website. Show the person the final text before you publish the story, as editing can change the meaning of a sentence. The same applies to photographs, as explained in Making a website welcoming for LGBTQ+ visitors.
How can you publish a story anonymously?
Offer everyone the option of publishing their story without their name or under a different first name, and say so below the story, for example ‘Name changed at the author’s request’. Remove details that could identify the person in combination, such as their employer, their exact age and the small town where they live. Do not illustrate an anonymous story with a photograph of the person, and check that the file names and alt text of the images on the page do not contain the person’s name.
What should you do when someone asks you to remove a story?
The GDPR states that withdrawing consent must be as easy as giving it. Remove the story from your website as soon as the person asks you to, without asking for a reason, and remove the story from your newsletter archive and social media where you can. Keep a short record of when consent was given and when it was withdrawn.
Which stories need a link to support?
Stories about discrimination, violence or mental health can affect readers who are going through something similar. End such a story with the contact details of a support service, such as a national LGBTQ+ helpline or your own organisation’s support team.
If you are unsure whether your consent form meets the requirements of the GDPR, consult a privacy adviser.
