Authority file closure query

[Mary Allen]

Hi all,

Apologies if this has been covered before. We've recently migrated all of our data from Calm to AtoM. One feature we found particularly useful in Calm was the ability to keep authority records unpublished. This is important for us because we have authority records for individuals who are still living, and making these publicly accessible could potentially create GDPR issues.

I haven't been able to find an equivalent option in AtoM. At the moment, we're considering deleting several authority records to prevent them from becoming public, which would be a shame.

Does anyone know whether it's possible to keep authority records unpublished or in draft in AtoM?

Thanks,

Mary

[Hans-Arno Mielsch]

Hi Mary,

I tried to solve this issue by moving the menu item "browseActors" from "browse" to "mainMenu/manage"

See our archive (in german) ...

Regards,

-Hans-Arno 

[Alberto Pereira]

Hi,

AtoM does not have a published/draft status for Authority Records. You can deny access to specific individual authority record pages, though. Through the ACL module, in Admin>Groups>Anonymous>Authority Record Permissions (see https://www.accesstomemory.org/en/docs/2.10/user-manual/administer/edit-permissions/#group-authority-record-permissions). 

The issue with this is that it does not hide them in the authority records list, nor in the search results (and maybe in some other places), even though it's just the name that's available. Removing these results can be done, but they require code editing.

If having just the name available is not an issue, you can use the permissions module as an alternative. 

--
You received this message because you are subscribed to the Google Groups "AtoM Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ica-atom-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ica-atom-users/ccd79e9f-b0e3-403a-b94d-580738707bfdn%40googlegroups.com.

[Johan Pieterse]

Hi Mary

Honest answer: no - not completely, without code. Base AtoM has no publish/draft status for authority records the way it does for archival descriptions. The only no-code lever is ACL, and it's partial - exactly as Alberto said.
 
What the no-code ACL route actually gets you:
- Admin > Groups > Anonymous > Authority record permissions > Read = Deny hides the authority detail pages (public gets 403).
- It does not remove the names from the actor browse list or from search results/facets - the actor index isn't ACL-filtered the way the description index is. So the name string still leaks; hiding that needs template/code edits.
 
Mary,
- The genuinely sensitive personal data (dates of birth, biographical history, addresses, relationships) lives in the authority record body, which the ACL deny does hide.
- What leaks is only the name in a list. A bare name in an archival authority list is usually a far lower GDPR exposure than a full biography. So ACL deny-read + keeping the record body minimal (name only, sensitive detail omitted or held in a linked, access-restricted description) is a defensible no-code posture for living individuals.
- If even the name must not appear, that's the point where code is unavoidable in stock AtoM.
 
Two things to flag on the other replies:
- Hans-Arno's menu trick (moving browseActors out of the browse menu) hides the menu entry only, it doesn't stop search or direct URLs. That's obscurity, not access control; don't rely on it for GDPR.
- Deleting the records (Mary's fallback) is the worst option, it destroys archival authority control. The ACL route is strictly better.
 

Dr. Johan Pieterse

The Archive and Heritage Digital Commons Group