Provisional changes to Living / Deceased defaults, and to deceased public / private

Started by Mike Stangel on Saturday, May 26, 2018
Problem with this page?


Profiles Mentioned:

Related Projects:

Showing 1-30 of 147 posts
5/26/2018 at 1:46 PM

Hi everyone,

As some of you have noticed, we released some changes last Wednesday in an effort to mitigate some of the privacy risks that are especially serious under recent legislation. I've been reluctant to post an announcement because I'm not sure we have the best algorithm dialed in just yet, but I do want everyone to understand what we're doing and why we're doing it. As a reminder, before Wednesday Geni had two simple rules regarding adding deceased profiles:

1. when you're adding onto a deceased profile the add-profile form defaults to deceased, and

2. when you add a deceased profile to Geni it is public by default.

Unfortunately we've seen that these simplistic rules can be especially problematic when our users build their tree up to deceased ancestors, and then back down to living cousins; unless users are paying close attention, they may not notice that they are adding deceased, public profiles for living people.

We don't want the pursuit of Geni's mission to be at odds with people's desire and right to personal privacy. The software should help you make good decisions about privacy, not hinder those decisions or hide them from you. To that end we've been experimenting with both the default selection for Living / Deceased on the add-profile form, and determining whether to mark deceased profiles private or public. Before I detail the algorithms, a couple definitions:

- "recently born or died" is defined here as birth year or estimated birth year in the past 125 years, or death year in the last 30 years.

- "recently born or died plus one generation" adds 35 to both, i.e. birth year or estimated birth year in the past 160 years, or death year in the last 65 years.

The two algorithmic changes we're experimenting with are:

1. Better defaults for Living / Deceased on the add-profile form. As they stand now, the rules are:

a. If we don't have dates to determine whether the profile being added onto is recently born or died, there is no default and you must explicitly select Living or Deceased.

b. If the profile being added onto is recently born or died, adding a child will default to Living. All other relationship types have no default.

c. If the profile being added onto has birth or death dates that pre-date our definition of recently born or died, adding sideways (spouse, sibling) or up (parent) will default to deceased. Adding a child will default to deceased if the profile being added onto is recently born or died plus one generation, otherwise adding a child will have no default.

2. Default-private for profiles that are recently deceased or may be accidentally marked deceased. When you add a deceased profile, as they stand now the rules for deciding private / public are:

a. Private if the profile is recently born or died

b. Private if any immediate family are Geni users ("claimed")

c. Public if a birth year was provided [more than 125 years ago or (2a) would have decided private]

d. Private if any spouses / partners or siblings are recently born or died, or if any parent is recently born or died plus one generation

e. Private if added sideways (spouse, sibling) or down (child) from a private profile

f. otherwise, Public

As always, you have the ability to set the privacy after you've added the profile, at the top of the edit-profile form (Basics tab).

Obviously these are more complicated than the rules we've been using for the past 5 years or so, which is why we're not ready to make a formal announcement that will be set in stone for years to come. We hope you'll give us your feedback as you gain practical experience working with these new rules, by replying to this discussion. Once we feel like we've got a set of rules that work well while offering our users the level of privacy they should expect, we'll update the online documentation and make a formal announcement.


5/26/2018 at 1:53 PM

Thank you, Mike. I like that the member needs to consciously and mindfully examine new profiles in the “possibly living” zone and make then make decisions.

Private User
5/26/2018 at 2:22 PM

Mike -

when you have both a birth date and a death date - do not think you should trigger from the death date.

am thinking -
1c - seems like it might result in errors. Siblings and Spouses may differ in age by 20 years or more

for example - if trigger from death date - child died shortly after birth, his info entered - then sibling entered -
death year that is more than 30 years ago should not mean the sibling is automatically entered as deceased. (Lots of us live to be quite a bit older than 30!!)

5/26/2018 at 5:44 PM

In my opinion, any deceased profile added should be public. Especially if a death date is provided, even if the person has recently died. A deceased person is a deceased person, and I see no reason for them to be private.

I think the effort should instead be made to make it more difficoult to add a living person as deceased. It has been very easy to do this by mistake, so I appreciate an improvement here. This would be achieved by one simple rule: When trying to add a recently deceased person, the user should be forced to mark the profile as EITHER living or deceased, with no default option. Why make it more complex than that?

(Adding onto living profiles should make living profiles by default, like it is today).

Private User
5/26/2018 at 6:20 PM

Please give family the time to mourn before a profile based on a deceased person is turned into a public profile.

Private User
5/26/2018 at 6:46 PM

I am hoping that I have kept ALL living family members Private.
(and some of the deceased as well)
; )
Guess I'll check.
Thank You for your work dialing in the algorithm.

5/26/2018 at 6:56 PM

A living profile connot be set to public. The problem occurs when living profiles are entered as deceased by mistake.

5/26/2018 at 7:20 PM

I am with Torbjørn Igelkjøn -- "any deceased profile added should be public.." Additionally, i have had my fill of "tetchy" relatives trying to retain privacy controls on our shared, deceased ancestors. I live in the USA and my rule is this: If the information is in the SSDI (Social Security death Index), then it is public information. SSDI records update about a month after death. No waiting for 125 years.

As far as the difficulties of accidentally making living people deceased, or vice versa -- i suggest a pop-up screen that simply forces a conscious choice on the uploader before the data can be submitted. Something like, "Before submitting this new record, please indicate whether this person is [] Living or [] Deceased."

Catherine Anna Manfredi Yronwode

I also live in the United States, that is not the issue here. Geni is an international business and must comply with the EU 's new laws regarding privacy. We users and curators have to go along. The SSDI says deceased but says nothing about privacy.

Private User
5/26/2018 at 9:08 PM


"...companies must be clear and concise about their collection and use of personal data like full name, home address, location data, IP address, or the identifier that tracks web and app use on smartphones. Companies have to spell out why the data is being collected and whether it will be used to create profiles of people’s actions and habits. Moreover, consumers will gain the right to access data companies store about them, the right to correct inaccurate information, and the right to limit the use of decisions made by algorithms..."

Private User
5/27/2018 at 3:48 AM

I think you should be aware of the fact that there is a high risk that 'recent' profiles will all be marked 'private', simply because managers are not aware of what's happening.
As a result I estimate that about 50% of the Holocaust victims will be private and as a result can't be added to relevant projects.
I urgently ask Geni to improve on current practice !

5/27/2018 at 6:14 AM

Eldon Clark (Geni volunteer curator), the new EU regulations are about privacy of living people, aren't they? I still see no reason (except Private User's point) why deceased profiles should be kept private. It is also still not forbidden for the user to set those profiles public. Forcing the user to take an active choice if a person is living or deceased should be sufficient to address the initial problem, regardless if there are new EU regulations.or not. The initial problem, as Mike Stangel formulated it above: "Unfortunately we've seen that these simplistic rules can be especially problematic when our users build their tree up to deceased ancestors, and then back down to living cousins; unless users are paying close attention, they may not notice that they are adding deceased, public profiles for living people". (And this problem needs to be addressed, regardless of the new regulations).

Setting all these profiles to private by default will make a lot of problems, like those Private User points out above.

However, if some deceased profiles should be kept private, I think the next best solution would be to have no privacy default for recently deceased profiles. Then, the user would have to take an active choice if he or she wants his/her profiles to be public or private. Just like the user should have to take an active choice if a person is living or deceased. As Mike Stangel said above: "The software should help you make good decisions about privacy, not hinder those decisions or hide them from you".

Private User
5/27/2018 at 7:10 AM

IMHO we have enough trouble with Zombies and PrivOmbies (Private profiles that look like Zombies) as it is. Defaulting to Living caused Zombies, defaulting to Deceased caused other problems. Maybe, as discussed here, the solution is to have no default but make the profile creator choose. (Common sense says anyone born before 1900 is *extremely* unlikely to be living in 2018.)

Private User
5/27/2018 at 7:53 AM

Private User - This policy is about profiles added - not about making changes to existing profiles. So why should it affect the Holocaust Victims? Haven't gung-ho folks already added most of those by now? And if not - the folks adding them can always choose to make them deceased if the software should happen to default them to living, and can always make any deceased profile public, so this should not be a problem.

Revealing information about the living is a much bigger problem - once it has been revealed, it cannot ever be guaranteed to be un-revealed.

Secrets can be at any time shared - once shared, they cannot go back to being un-shared.

And please note - since merging a Public profile with no information with one someone purposely set as private and put lots of info on, both private family info about the deceased (possibly very recently deceased, possibly entered when still living and so could not be made public) and about living members of the family, info it was expected only family would see, results in a Public Profile all the World can see, with all that info expected to be private now viewable by all.

Private User
5/27/2018 at 9:55 AM

No Lois, we haven't added most of them by now. We have only added a fraction of them

And no, it IS a problem because the software is ONLY asking if a person is living or deceased if it is 'recent' and NOT making it public by default if a profile is indeed deceased. So in fact 2 actions have to be taken and by far most users are now unaware of this. It happened to me and I've seen it happen to others.

I'm not that hysterical about the last problem you mention. I don't recognize it. I've never seen a profile with sensitive information and I've seen hundreds of thousands of them. But that's of course just me.

5/27/2018 at 10:16 AM

Regarding sensitive information on profiles - I never add any information into a profile (living or deceased) that I don't think should be shared.
Family see information on living profiles and they would be the ones most hurt by it.

I too have not come across any profiles with sensitive information on them.

5/27/2018 at 10:33 AM

Regarding sensitive information on profiles, I know of a very well known person who had a long term affair. I asked a family member and was told the family did not want the mistress on the tree, so she is not there. There were no children involved.

5/27/2018 at 11:04 AM

In 8 years of curating I have never seen any “secrets” on any private profile. Regardless of default settings etc, don’t put on the internet what isn’t already public.

5/27/2018 at 11:22 AM

If someone shares a secret with all his/her fourth cousins, it isn't a secret anymore. ;-)

Private User
5/27/2018 at 11:35 AM

All of you who think you have not seen any sensitive information on profiles - you have of course seen sensitive information, you just have not recognized it as such. "Personal information, described in United States legal fields as either personally identifiable information (PII), or sensitive personal information (SPI),[1][2][3] as used in information security and privacy laws, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context." --
"The following data, often used for the express purpose of distinguishing individual identity, clearly classify as PII under the definition used by the National Institute of Standards and Technology" [and recall PII is another acronym for SPI = sensitive personal information] --
Full Name if not common
Date of Birth
-- -- -- You are not going to tell me you have never seen a profile with any of those entered. [possibly others in the list on the website maybe you haven't]
"The following are less often used to distinguish individual identity, because they are traits shared by many people. However, they are potentially PII, because they may be combined with other personal information to identify an individual.
First or last name, if common
Country, state, postcode or city of residence
Age, especially if non-specific
Gender or race
Name of the school they attend or workplace"
-- I have seen each of the above on profiles. Imagine each of you has as well.

5/27/2018 at 12:10 PM

If I do a reverse search for a phone number, I also see the name of the person who own the phone number. Still, phone lookup services on the Internet are not forbidden.

There are many dilemmas about family threes on the Internet and privacy. If we can't put information about living persons or people who have died the last 125 years on the Internet, it is the end of the Geni World Three as we know it.

However, the present changes are addressing the problem that people add living people as deceased, without being aware of it. That problem is solved by forcing the user to decide if the profile is "living" or "deceased". If there is a need to keep some newly deceased profiles private, this can be done by ALSO forcing the user to decide if the profile should be public or private INSTEAD of making those profiles private by default. Setting those profiles to private by default will make a lot of zoombie-like profiles which the users who entered them are unaware of. That was not the intention, and will make work on the World Three more difficoult for all users.

Private User
5/27/2018 at 1:03 PM

Torbjørn Igelkjøn - I believe you have the right to have your name removed from those official sites that do reverse phone number searches.

When I started on Geni, they had not figured out how to do any merges yet, and there was no such thing as a Public Profile. Then we were assured we could keep profiles private back 4 generations, and that outside their own families, folks would only want to be working on Historical profiles - "Historical" meaning way back, as well as of Historical importance/interest. As far as I know, this is supposed to still be the case. Have folks really finished all the work that can be done on people that died before 1800? before 1850?
Geni has switched from Profiles always private to sometimes public, to a default of public if far removed from the person who added them, to private if alive and a default of public if deceased, and now the rules are changing again. Expect change.
The Geni World Tree has not always been what you think of it as now, and no reason it should not change many more times.

Geni's matching algorithm works whether the profile is public or private. Curators can merge them even if one or both are private. If neither of these were true, then this change would be a much bigger problem. As it is, the new defaults may actually increase the chances of matches being found by Geni, since geni tends not to suggest matches between a living profile and a deceased profile, and now fewer living profiles will be being added as deceased - at least, hopefully.

5/27/2018 at 3:07 PM

Private User if information is available on public records I do not consider it "sensitive" in Geni .

What I would is information that is only known to family members or other close associates that is not intended for anything other than genealogy purposes, as this is a genealogy site.

I stand by my statement that geni members, in my experience, are tasteful and careful. We are serious people here with no desire to cause harm.

5/27/2018 at 11:09 PM

Personally Identifiable Information and Sensitive Information is not the same thing.

Information that is publicly available as a matter of law is not considered sensitive.

5/27/2018 at 11:58 PM

As far as I can determine, there is no legal requirement for any profile (living or deceased) on Geni to be private. Geni is making a business decision here, but we should be clear it is not being required to do this by GDPR or any other law.

Private User
5/28/2018 at 1:22 AM

European law privacy issues??

Private User
5/28/2018 at 8:59 AM

Erica Howton and Harald Tveit Alvestrand -- You saw the link to Wikepedia where it clearly was referring to "personally identifiable information (PII), or sensitive personal information (SPI)" as being equivalent terms.
If Wikepedia has it that way, then in all likelihood there are at least some folks who understand the terms that way - if it has been on Wikepedia for more than a second, probably many do.
The fact that that is not how you use the terms does not mean that is not how others use or interpret the terms.

To me, the fact that some information can be located in a publicly available source does not in any way mean it cannot also be "sensitive information".

I went searching for a definitive definition of the term "sensitive information" and found the Wikepedia article, which I linked to and quoted above.
Another link on the topic, supporting the idea that the definition is not clear, and presenting possible interpretations:

5/28/2018 at 10:03 AM

Private User the intro to that article is badly phrased. a little further down in the article, you can read: "According to the OMB, it is not always the case that PII is "sensitive", and context may be taken into account in deciding whether certain PII is or is not sensitive.[22][full citation needed]"

I've worked with PII and SPI definitions in my job. They're different - and have so many different definitions (especially of SPI) that the term alone is almost useless.

I'm not, however, surprised to find that there are sources that make the difference hard to see.

Private User
5/28/2018 at 8:08 PM

Thank you for the heads-up on upcoming changes. Being from the USA, I'm used to our lack of privacy, so things like "right to be forgotten" has taken some mental work for me to wrap my brain around it but I think I understand it now and find it admirable.

The GDPR is a step towards an internet of a better future that allows for consent of the individual and I think you at geni are working well through this ethical considerations. Thank you.

Private User
5/29/2018 at 6:39 AM

The GDPR wasn't written for sites like Geni, but I believe it would still apply.The site is collecting and publicizing personal data.

Showing 1-30 of 147 posts

Create a free account or login to participate in this discussion